Description
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | < 2.6.0 | 2.6.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.vikunja.io/api | < 2.6.0 | 2.6.0 | GHSA-m469-88xx-8rx2 |
| Go | code.vikunja.io/api | all versions | — | GO-2026-6737 |
References
- GitHub Security Advisory (GHSA-m469-88xx-8rx2) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth third-party-advisory