{"id":"EUVD-2026-78653","enisaUuid":"394fb9a2-5440-3f72-bb78-2e4920c4551b","description":"Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.","datePublished":"Sep 15, 2026, 3:18:26 PM","dateUpdated":"Sep 17, 2026, 3:14:33 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api\n","aliases":"CVE-2026-91982\nGHSA-jmr8-r558-3jhx\nGHSA-88f6-4rjv-x774\n","assigner":"VulnCheck","epss":0.35,"enisaIdProduct":[{"id":"b4c65d77-e942-3645-9dd8-6133abdf81d1","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"a669c40c-9162-3135-a568-3bade455d00c","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"10f4cd4f-37e5-3d2e-8679-259aae70f955","vulnerability":{"id":"GHSA-88f6-4rjv-x774","description":"Vikunja: TOTP secret is readable after enrollment, no step-up auth","datePublished":"Oct 9, 2026, 8:51:17 PM","dateUpdated":"Oct 9, 2026, 8:51:17 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91982\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api\n","enisa_id":"EUVD-2026-78653\n","aliases":"GHSA-88f6-4rjv-x774\nCVE-2026-91982\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b50e18cb-62cd-3fb2-8022-f33e2dffa6fb","vulnerability":{"id":"GHSA-jmr8-r558-3jhx","description":"Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:51:10 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91982\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api\n","enisa_id":"EUVD-2026-78653\n","aliases":"GHSA-jmr8-r558-3jhx\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c8773665-843b-3dc9-8ac5-7c3ff1f481bd","vulnerability":{"id":"CVE-2026-91982","description":"Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.","datePublished":"Sep 15, 2026, 3:18:26 PM","dateUpdated":"Sep 17, 2026, 3:14:33 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api\n","enisa_id":"EUVD-2026-78653\n","assigner":"VulnCheck","epss":0.35,"dataProcessed":"Nov 5, 2026, 7:17:35 AM","vulnerabilityProduct":[{"id":"44740fb7-27a8-3481-add0-64d8e51614da","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"38c28ff4-3ae5-3bec-b984-9a566e9dfad5","vendor":{"name":"go-vikunja"}}]}}],"enisaIdAdvisory":[]}