6 matches found
CVE-2026-91973
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...
CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...
CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...
CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...
CVE-2026-91973
Vikunja before 2.6.0 is affected by an authentication bypass in its CalDAV BasicAuth endpoints , which lack rate limiting. Remote unauthenticated attackers can issue unbounded credential-guessing requests against the /dav, /.well-known, and /feeds routes, bypassing the instance's anti-brute-force...
CVE-2026-91973: Improper Restriction of Excessive Authentication Attempts
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...