CVE-2026-28268
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.67%
- CWE
- CWE-459, CWE-640
- Published
- 2026-02-27
- Last modified
- 2026-03-12
Affected products
- go-vikunja vikunja
Weakness type
Related vulnerabilities
- CVE-2026-87549 — Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87436 — Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87446 — Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-85043 — Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to...
- CVE-2026-78600 — Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
- CVE-2026-77037 — multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- CVE-2026-82237 — filebrowser through 2.63.23 Stale Share Link via File Rename
- CVE-2026-82236 — File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion