{"id":"EUVD-2026-78648","enisaUuid":"85237ed5-be37-3755-af69-d60755a58fc8","description":"Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.","datePublished":"Sep 15, 2026, 3:18:22 PM","dateUpdated":"Sep 17, 2026, 3:12:40 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6rvj-qwjf-3m4q\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-unthrottled-api\n","aliases":"CVE-2026-91972\nGHSA-m4vj-wr5q-cmvr\nGHSA-6rvj-qwjf-3m4q\n","assigner":"VulnCheck","epss":0.63,"enisaIdProduct":[{"id":"ec3be0a9-9adb-316f-a36d-6c111e4806f0","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"2a8b8768-31fb-3809-825e-6fb08e916abd","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"8942f18f-2f02-3d04-8a60-74a774526318","vulnerability":{"id":"GHSA-m4vj-wr5q-cmvr","description":"Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:50:59 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6rvj-qwjf-3m4q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91972\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-unthrottled-api\n","enisa_id":"EUVD-2026-78648\n","aliases":"GHSA-m4vj-wr5q-cmvr\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c76cb6f2-98d7-356c-bfb4-007fb3ee8fbf","vulnerability":{"id":"CVE-2026-91972","description":"Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.","datePublished":"Sep 15, 2026, 3:18:22 PM","dateUpdated":"Sep 17, 2026, 3:12:40 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6rvj-qwjf-3m4q\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-unthrottled-api\n","enisa_id":"EUVD-2026-78648\n","assigner":"VulnCheck","epss":0.63,"dataProcessed":"Nov 7, 2026, 7:21:11 AM","vulnerabilityProduct":[{"id":"1361b56e-679c-3736-8891-341591ce7a79","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"0980374a-f7ff-3bc7-a3c3-b2c1cf2be751","vendor":{"name":"go-vikunja"}}]}},{"id":"daf9e5c4-12ea-3ae9-a4a1-fdcbae391462","vulnerability":{"id":"GHSA-6rvj-qwjf-3m4q","description":"Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited","datePublished":"Oct 9, 2026, 8:51:05 PM","dateUpdated":"Oct 9, 2026, 8:51:05 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-6rvj-qwjf-3m4q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91972\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-unthrottled-api\n","enisa_id":"EUVD-2026-78648\n","aliases":"GHSA-6rvj-qwjf-3m4q\nCVE-2026-91972\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}