Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) >= 2.2.0, <= 2.6.0; Vikunja up to commit a881ac39eecd07575a5aede8e74727c28d5fd578.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vikunja CORS misconfiguration allows token theft from localhost pages

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Reconfigure cors.origins to contain only the intended production hostname and remove the localhost entries, or disable CORS entirely if not needed. Alternatively, set cors.enable to false if the application does not require cross-origin API access. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · Published 2026-10-09

Vikunja is a task management and project planning application. By default it allows API requests from any page running on the user's own machine (localhost), combined with automatic credential sending. An attacker can craft a malicious page that when visited by a logged-in Vikunja user steals their authentication token and gains full account access, including the ability to read, modify, or delete all tasks and projects.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) >= 2.2.0, <= 2.6.0; Vikunja up to commit a881ac39eecd07575a5aede8e74727c28d5fd578.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Reconfigure cors.origins to contain only the intended production hostname and remove the localhost entries, or disable CORS entirely if not needed. Alternatively, set cors.enable to false if the application does not require cross-origin API access. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Reconfigure cors.origins to contain only the intended production hostname and remove the localhost entries, or disable CORS entirely if not needed. Alternatively, set cors.enable to false if the application does not require cross-origin API access.

Technical details

Vikunja's CORS configuration defaults to trusting all origins on localhost:* and 127.0.0.1:*, and allows credentials (AllowCredentials: true). When a production hostname is configured via service.publicurl, it is appended to rather than replacing these localhost entries. An attacker can serve a page from localhost on any port; that page makes a credentialed POST request to the refresh token endpoint, which returns a fresh JWT in the response body readable by JavaScript due to the permissive CORS policy. The refresh token cookie is marked SameSite=None to support split-origin deployments, allowing it to be sent cross-site from localhost pages.

Affected products

Vikunja Vikunja up to commit a881ac39eecd07575a5aede8e74727c28d5fd578

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.