CVE-2026-91973

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91973
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91973.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91973
Aliases
  • GHSA-m469-88xx-8rx2
Published
2026-09-15T15:18:23Z
Modified
2026-09-18T03:31:00Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Details

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91973.json"
}
References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type
GIT
Repo
https://github.com/go-vikunja/vikunja
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a4218eeb8fb3ada95e14a2331731524c9120d5bd
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*
v0.1
v0.10
v0.11
v0.12
v0.13
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.19.0
v0.19.1
v0.19.2
v0.2
v0.20.0
v0.20.1
v0.20.3
v0.20.4
v0.21.0
v0.22.0
v0.22.1
v0.23.0
v0.24.1
v0.3
v0.4
v0.5
v0.6
v0.7
v0.8
v0.9
v1.*
v1.0.0
v1.0.0-rc0
v1.0.0-rc1
v1.0.0-rc2
v1.0.0-rc3
v1.0.0-rc4
v1.1.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.2.1
v2.2.2
v2.3.0
v2.4.0
v2.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91973.json"