EUVD-2026-78649

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords...

PT-2026-92092

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description An authentication bypass exists in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can perform unbounded credential-guessing requests against the '/dav...