Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) >= 2.3.0, <= 2.6.0; Vikunja 2.6.0.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Vikunja WebSocket authentication bypass ignoring session revocation

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Restrict WebSocket access by disabling the WebSocket endpoint or placing it behind network controls if live notifications are not required. Monitor for unexplained WebSocket connections using revoked sessions by logging and auditing session deletions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Severity: medium · CVSS 6.5 · Published 2026-10-09

Vikunja is a task and project management platform that uses WebSocket connections to deliver live notifications and updates to users. A session revocation flaw allows attackers with stolen access tokens to maintain a persistent connection that continues receiving private notifications (mentions, task details, project information) even after the legitimate user revokes all sessions or enables two-factor authentication. This effectively allows indefinite eavesdropping on a user's notifications until the attacker manually disconnects.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) >= 2.3.0, <= 2.6.0; Vikunja 2.6.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Restrict WebSocket access by disabling the WebSocket endpoint or placing it behind network controls if live notifications are not required. Monitor for unexplained WebSocket connections using revoked sessions by logging and auditing session deletions.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict WebSocket access by disabling the WebSocket endpoint or placing it behind network controls if live notifications are not required. Monitor for unexplained WebSocket connections using revoked sessions by logging and auditing session deletions.</anigation> </invoke>

Technical details

The WebSocket endpoint validates JWTs only by signature and token type, ignoring the session ID (sid) claim that ties tokens to server-side sessions. When a user revokes a session via DELETE /api/v2/user/sessions/{id} or enables TOTP (which calls DeleteAllUserSessions), the WebSocket hub does not validate or drop connections using that token, and new connections are accepted with revoked tokens. Attack requires network access to Vikunja's WebSocket endpoint and possession of a pre-revocation user JWT; no additional authentication or user interaction is needed once the token is obtained.

Affected products

Vikunja Vikunja 2.6.0

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.