CVE-2026-111917
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows…
- Risk score
- 45/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 17 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after ses…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.7.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.
Last activity 17 Oct 2026. Patch Forecast updates every hour.