CVE-2026-123528

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

EUVD-2026-119413

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

CVE-2026-123528

Vikunja versions before 2.7.1 are vulnerable to an insufficient session expiration flaw due to the SetupTokenMiddleware skipping necessary session and account-status checks. This allows holders of revoked access tokens to maintain authentication. Specifically, an attacker with a stolen token can ...

CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

CVE-2026-123528: go-vikunja vikunja: Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access…

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

PT-2026-139809

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...