Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over...

CVE-2026-62367

In Vikunja versions 1.0.0 through 2.3.0 , a vulnerability exists where an administrator enabling the emailfallback option on an OpenID Connect (OIDC) provider allows for local account takeover. The system incorrectly links an SSO login to a pre-existing local (username+password) account using onl...

EUVD-2026-95993

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...

CVE-2026-62367 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...

CVE-2026-62367 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Summary With the per-provider OIDC emailfallback option enabled, Vikunja links an SSO login to a pre-existing local username+password account using only the email claim — no emailverified or Microsoft xmsedov check and no password check, on the unauthenticated callback. An attacker who can make t...

GHSA-XV7Q-FVMC-JX96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Summary With the per-provider OIDC emailfallback option enabled, Vikunja links an SSO login to a pre-existing local username+password account using only the email claim — no emailverified or Microsoft xmsedov check and no password check, on the unauthenticated callback. An attacker who can make t...

CVE-2026-108263

Astron Agent , an agentic workflow platform, is vulnerable to cross-tenant Remote Code Execution (RCE) in versions prior to 1.1.2 . The root cause lies in the LocalExecutor within core/workflow/engine/nodes/code/code_node.py, which is selected by default via the /console-api/workflow/code/run and...

EUVD-2026-95992

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/codenode.py when CODEEXECTYPE is not explicitly...

CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/codenode.py when CODEEXECTYPE is not explicitly...

CVE-2026-108263 Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/codenode.py when CODEEXECTYPE is not explicitly...

CVE-2026-57458

The Vikunja task management platform (version 2.3.0 ) contains a vulnerability where a scoped API token restricted to the oauth.authorize permission can be used to mint unrestricted OAuth session credentials. Specifically, an attacker can call POST /api/v1/oauth/authorize to obtain an authorizati...

CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

EUVD-2026-95991

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

GHSA-P393-CF76-4JMR Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

Summary Vikunja's web.Auth interface pkg/web/web.go, single method GetID int64 is satisfied by BOTH user.User and models.LinkSharing. A link-share's GetID returns the raw positive share.ID pkg/models/linksharing.go:83-85, which lives in the same positive autoincrement ID space as users.id. The sa...