CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-57458: Improper Privilege Management

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

PT-2026-109320

Name of the Vulnerable Software and Affected Versions Vikunja version 2.3.0 Description An authentication-context mismatch allows a scoped API token limited to the oauth.authorize permission to bypass its declared restrictions. By calling the 'POST /api/v1/oauth/authorize' endpoint, an attacker c...

CVE-2025-27232: Server-Side Request Forgery (SSRF)

An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss...