Authentication Bypass

code.vikunja.io/api is vulnerable to an authentication bypass. The vulnerability is due to the emailfallback option linking an SSO login to an existing local account without verifying the email claim or requiring the account password, which allows an attacker with a token containing the victim’s...

CVE-2026-62367

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider "emailfallback" option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the "email"...

PT-2026-109321

Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0 through 2.3.0 Description When an administrator enables the per-provider emailfallback option on an OpenID Connect provider, the software links an SSO login to a pre-existing local account using only the email claim from...

CVE-2026-62367: Improper Authentication

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...