{"id":"CVE-2026-62367","revision":"272611cb808b47fbb65d1b9716c3ea1f","records":[{"revision":"272611cb808b47fbb65d1b9716c3ea1f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-62367","aliases":[],"title":"Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover","description":"Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.","state":0,"publishedAt":"2026-10-09T20:49:08.891+00:00","modifiedAt":"2026-10-13T20:25:26.027+00:00","affected":[{"ecosystem":"Vendor product","name":"vikunja","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"go-vikunja\",\n                    \"product\": \"vikunja\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 2.4.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96","https://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630","https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62367","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-62367","identifiers":["CVE-2026-62367"]},"retained":false,"historicalAffected":[]}],"coverage":[]}