CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

CVE-2026-91982

Vikunja before 2.6.0 exposes the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /qrcode endpoints without requiring re-authentication. An attacker holding a valid access token can read the secret, import it into their own authenticator app, and generate val...

CVE-2026-91982: Insufficiently Protected Credentials

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...