Description
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | < 2.7.1 | 2.7.1 |
References
- GitHub Security Advisory (GHSA-3rrq-h284-5vpx) vendor-advisory
- VulnCheck Advisory: Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server third-party-advisory