Critical Flaws in Vikunja Expose Users to Persistent Account Takeovers

Vikunja is a popular open-source, self-hostable to-do application designed to help users organize their tasks using list, Kanban, Gantt, and table views while keeping their data entirely under their own control. However, a pair of highly critical security vulnerabilities has been disclosed that could allow cybercriminals to hijack user accounts permanently.

These flaws, which affect all Vikunja versions up to and including v2.0.0, create a dangerous scenario where recovering a compromised account becomes nearly impossible for the victim.

The first vulnerability, tracked as CVE-2026-27575 (CVSS 9.1), stems from a dangerous combination of weak password enforcement and persistent user sessions.

The application previously allowed users to set incredibly weak passwords, such as “1234” or a single character, without enforcing any minimum length or strength requirements. This makes accounts highly susceptible to brute-force or credential-stuffing attacks.

The real danger, however, lies in what happens after an account is compromised. If an attacker guesses a weak password and logs in, they are granted an active session token. If the legitimate user later realizes their account is at risk and changes their password, the application fails to forcefully log out other active sessions. This means the attacker’s original session remains perfectly valid, granting them persistent, uninterrupted access to the victim’s sensitive data even after the password has been changed.

The second vulnerability, tracked as CVE-2026-28268 (CVSS 9.8), involves a critical logic error in the system’s automated cleanup routine, creating what is effectively an infinite attack window.

When a user requests a password reset or an account deletion, the system generates a temporary token. A background task (a cron job) is scheduled to delete these tokens after 24 hours to ensure they expire and cannot be abused. However, a simple mathematical error in the database code reversed this intended logic.

By accidentally using a “greater than” (>) symbol instead of a “less than” (<) symbol in the code, the system was instructed to delete tokens created within the last 24 hours. As a result, the system continuously deleted brand-new, valid tokens while keeping old, expired tokens active forever.

Because these old tokens are never cleared from the database, an attacker who manages to obtain a single password reset token can use it to reset the victim’s password an unlimited number of times. Even if the victim notices the suspicious activity and changes their password to secure the account, the attacker can simply reuse the immortal token to take the account right back.

Both of these vulnerabilities lead to the exact same devastating result: persistent account takeover.

Fortunately, the maintainers have addressed both the session management flaw and the broken cleanup logic. To properly secure their environments, administrators hosting Vikunja must update their instances to the patched release, version v2.0.1, immediately. Additionally, the recommended fix includes updating the password reset function to automatically invalidate and delete a token the moment it is successfully used.