CVE-2026-123497 Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens...