GO-2026-6715 Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GHSA-4HV6-XC92-J86G Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...