CVE-2026-123494

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123494

Vikunja versions prior to 2.7.1 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the migration OAuth callbacks for Todoist , Microsoft To Do , and Trello . The root cause is the absence of a bound state parameter in these callbacks. An attacker can authorize their own account, re...

EUVD-2026-119379

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123494 Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123494 Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-123494: go-vikunja vikunja: Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data…

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

PT-2026-139775

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...