CVE-2026-123499 Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANSTOKEN as a Bearer token, or login passwords, TO...

CVE-2026-123499

Vikunja veans versions before 2.7.1 are vulnerable to a credential exposure vulnerability. A malicious repository author can capture API tokens by specifying an attacker-controlled server in a .veans.yml file. When veans is executed in an untrusted checkout, it transmits the VEANS_TOKEN as a Bear...

EUVD-2026-119384

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANSTOKEN as a Bearer token, or login passwords, TO...

CVE-2026-123499: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to…

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANSTOKEN as a Bearer token, or login passwords, TO...