Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-35597: Vikunja task manager allows unlimited TOTP login tries

CVE-2026-35597 · published 6 months ago

Summary

Versions of Vikikja before 2.3.0 do not correctly lock an account after repeated wrong two‑factor codes, so an attacker can keep guessing codes without being blocked. This lets a brute‑force attack try many one‑time passwords until a correct one is found. Update Vikikja to version 2.3.0 or later to enable proper account lockout.

What to do

Update code.vikunja.io api to version 2.3.0.
Update vikunja vikunja to version 2.3.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	code.vikunja.io	api	<= 2.2.2 Fix: upgrade to 2.3.0
–	vikunja	vikunja	< 2.3.0 `cpe:2.3:a:vikunja:vikunja::::::::`

Original advisory text

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then unconditionally rolls back. HandleFailedTOTPAuth in pkg/user/totp.go uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone. The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time. This allows unlimited brute-force attempts against TOTP codes. This vulnerability is fixed in 2.3.0.

References

https://github.com/go-vikunja/vikunja/commit/6ca0151d02fa0e8c7e2181ab916a28e08ca... Patch
https://github.com/go-vikunja/vikunja/pull/2576 Issue Tracking
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 Release Notes
https://github.com/advisories/GHSA-fgfv-pv97-6cmj
https://nvd.nist.gov/vuln/detail/CVE-2026-35597 Vendor Advisory
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fgfv-pv97-6cmj Exploit Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35597... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-307Improper Restriction of Excessive Authentication Attempts

Timeline

Published10 Apr 2026

Updated3 Nov 2026

First seen10 Apr 2026

Sources

GHSA-fgfv-pv97-6cmj · GHSA

CVE-2026-35597 · NVD

CVE-2026-35597 · OSV

Track software like this

Free during beta