GHSA-p2vv-wrh8-x466
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p2vv-wrh8-x466
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-p2vv-wrh8-x466/GHSA-p2vv-wrh8-x466.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p2vv-wrh8-x466
- Withdrawn
- 2026-10-09T20:51:57Z
- Published
- 2026-09-15T18:32:30Z
- Modified
- 2026-10-09T21:00:06Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
- Details
-
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m469-88xx-8rx2. This link is maintained to preserve external references.
Original Description
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
- Database specific
{ "cwe_ids": [ "CWE-307" ], "github_reviewed": true, "github_reviewed_at": "2026-10-09T20:51:57Z", "nvd_published_at": "2026-09-15T16:17:54Z", "severity": "HIGH" }- References
Affected packages
Go / code.vikunja.io/api
Package
- Name
- code.vikunja.io/api
- View open source insights on deps.dev
- Purl
- pkg:golang/code.vikunja.io/api