CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581

Vikunja versions 0.22.0–2.3.0 are affected by an authentication bypass in API token management caused by principal-id collision: user IDs and link-share IDs share a numeric space via a generic web.Auth.GetID() interface, enabling a link-share JWT with a numeric ID equal to a target user ID to be ...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

EUVD-2026-51991

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-16062

creationtimestamp| type| source ---|---|--- 2026-08-02 10:50:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ss6ptam2v...

CVE-2026-16292

creationtimestamp| type| source ---|---|--- 2026-08-02 10:10:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qk37jco2s 2026-08-02 11:43:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vqaq2cw2d 2026-08-02 11:43:01+00:00| seen|...

CVE-2026-18573

creationtimestamp| type| source ---|---|--- 2026-08-02 10:08:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qhbd6vx2g...

CVE-2026-18556

creationtimestamp| type| source ---|---|--- 2026-08-01 21:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6yk3ai2b622lz 2026-08-02 03:27:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117023665141420912 2026-08-02 06:36:08+00:00| seen|...

CVE-2026-67292

creationtimestamp| type| source ---|---|--- 2026-08-01 20:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bpofl4v2m 2026-08-04 09:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msapafceeg2s 2026-08-05 02:18:03+00:00| seen|...

CVE-2026-66402

creationtimestamp| type| source ---|---|--- 2026-08-01 20:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bm2o5mc2a 2026-08-02 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms3mnkwzbp2x 2026-08-02 09:02:35+00:00| seen|...

CVE-2026-67328

creationtimestamp| type| source ---|---|--- 2026-08-01 18:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms22etaago2p 2026-08-01 22:34:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2jolkde62v 2026-08-01 22:34:53+00:00| seen|...

CVE-2025-71403

creationtimestamp| type| source ---|---|--- 2026-08-01 13:47:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrzm7fofvq22...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

EUVD-2026-51841

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327

Better-Auth before 1.6.22 is vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers a victims email with a chosen password; the account remains unverified. When the victim signs in later...

CVE-2026-18344

creationtimestamp| type| source ---|---|--- 2026-08-01 10:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hcboak6644dts 2026-08-01 17:43:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzzfowyul2l 2026-08-01 17:44:05+00:00| seen|...