Vulnerability Database - OSV

CVE-2026-91982

github.com/go-vikunja/vikunja

Vikunja before 2.6.0 TOTP Secret Disclosure via API 15 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-88f6-4rjv-x774

Go/code.vikunja.io/api

Vikunja: TOTP secret is readable after enrollment, no step-up auth 5 days ago

Fix available
Severity - 5.3 (Medium)