Skip to content
OpenAdvisories

Vendor

go-vikunja

105 known vulnerabilities.

Products

vikunja 105
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-62367 Public exploit

    Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

    Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+…

    go-vikunja vikunja code.vikunja.io/api Go