GO-2026-6721 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

🗓️ 19 Oct 2026 21:08:26Reported by GoogleType

osv_go🔗 osv.dev👁 4 Views

Unthrottled pre-auth endpoints in Vikunja /api/v2 on stock installs.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-91972	9 Oct 202620:51	–	circl
CVE	CVE-2026-91972	15 Sep 202615:18	–	cve
Cvelist	CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API	15 Sep 202615:18	–	cvelist
EUVD	EUVD-2026-78648	9 Oct 202620:51	–	euvd
Github Security Blog	Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited	9 Oct 202620:51	–	github
Github Security Blog	Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited	15 Sep 202618:32	–	github
Mend	CVE-2026-91972	15 Sep 202615:18	–	mend
NVD	CVE-2026-91972	15 Sep 202616:17	–	nvd
osv_ghsa	GHSA-6RVJ-QWJF-3M4Q Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited	9 Oct 202620:51	–	osv_ghsa
osv_ghsa	GHSA-M4VJ-WR5Q-CMVR Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited	15 Sep 202618:32	–	osv_ghsa

Source	Link
github	www.github.com/go-vikunja/vikunja/security/advisories/GHSA-6rvj-qwjf-3m4q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-91972
github	www.github.com/go-vikunja/vikunja/releases/tag/v2.6.0
vulncheck	www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-unthrottled-api

19 Oct 2026 21:31Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

CVSS 48.7

EPSS0.00633

Vikunja pre-auth unthrottled /api/v2