Authentication Bypass

code.vikunja.io/api is vulnerable to an authentication bypass. The vulnerability is due to the emailfallback option linking an SSO login to an existing local account without verifying the email claim or requiring the account password, which allows an attacker with a token containing the victim’s...