CVE-2026-123513

Vikunja versions prior to 2.7.1 are vulnerable to a credential exposure vulnerability (CWE-201) caused by the checkAndSetApiUrl function. This flaw allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because the application leaves origin-independent loca...