CVE-2026-111917

Vikunja versions 2.3.0 before 2.7.0 are vulnerable to an improper session validation flaw. The handleAuth function fails to verify the JWT sid claim against the sessions table, allowing attackers with a stolen access token to maintain active WebSocket connections at /api/v2/ws even after the sess...

EUVD-2026-103304

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections t...