Vikunja Authentication Bypass Vulnerabilities Discovered

• •Two authentication bypass vulnerabilities in Vikunja before version 2.6.0.
• •Exploitation methods include Caldav Basic Authentication and unthrottled API access.
• •Immediate action is recommended as vulnerabilities are currently unpatched.

Two critical authentication bypass vulnerabilities have been identified in Vikunja versions prior to 2.6.0. The first vulnerability allows unauthorized access via Caldav Basic Authentication, while the second exploits an unthrottled API. These vulnerabilities could potentially allow attackers to gain unauthorized access to sensitive data. Organizations using affected versions are at risk, particularly those relying on Caldav for calendar management and API integrations. No specific CVEs have been assigned yet, but immediate action is advised for users to mitigate risks. Both vulnerabilities were disclosed on September 16, 2026, and are currently unpatched. Security teams are urged to monitor for further updates and apply patches as soon as they are available.