CVE-2026-57458 · GHSA-v3p6-34mc-hj7v
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
- Risk score
- 57/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web Token (JWT) and refres…
- Affected
- code.vikunja.io/api (go) = 2.3.0
- Fix
- Upgrade code.vikunja.io/api to 2.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | = 2.3.0 | 2.4.0 |
References
- https://github.com/advisories/GHSA-v3p6-34mc-hj7v
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v3p6-34mc-hj7v
- https://github.com/go-vikunja/vikunja/commit/4ae2e093014881052ed8f8ecd8bcb9adf83dd276
- https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
- https://github.com/advisories/GHSA-v3p6-34mc-hj7v
Original description
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
Last activity 9 Oct 2026. Patch Forecast updates every hour.