{"id":"EUVD-2026-95993","enisaUuid":"af48058f-ba90-37d5-a1a0-353ee520049b","description":"Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account\u0027s password. An attacker who can obtain a token from the configured issuer carrying a victim\u0027s email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.","datePublished":"Oct 9, 2026, 8:49:08 PM","dateUpdated":"Oct 13, 2026, 8:25:26 PM","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96\nhttps://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.4.0\n","aliases":"CVE-2026-62367\nGHSA-xv7q-fvmc-jx96\n","assigner":"GitHub_M","epss":0.09,"enisaIdProduct":[{"id":"65b51822-7253-3c26-83bf-4499dd0c4ff7","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"1.0.0, \u003c 2.4.0"}],"enisaIdVendor":[{"id":"9e06e1fe-f278-3e80-b3d6-13b18caaf634","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"167dcde0-9910-3292-8b62-0b975c5044e1","vulnerability":{"id":"GHSA-xv7q-fvmc-jx96","description":"Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover","datePublished":"Oct 9, 2026, 8:49:06 PM","dateUpdated":"Oct 9, 2026, 8:49:06 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96\nhttps://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.4.0\n","enisa_id":"EUVD-2026-95993\n","aliases":"GHSA-xv7q-fvmc-jx96\nCVE-2026-62367\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"63642ef2-feac-31ad-a600-a08992b7eaa2","vulnerability":{"id":"CVE-2026-62367","description":"Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account\u0027s password. An attacker who can obtain a token from the configured issuer carrying a victim\u0027s email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.","datePublished":"Oct 9, 2026, 8:49:08 PM","dateUpdated":"Oct 13, 2026, 8:25:26 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96\nhttps://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.4.0\n","enisa_id":"EUVD-2026-95993\n","assigner":"GitHub_M","epss":0.09,"dataProcessed":"Oct 28, 2026, 7:14:28 AM","vulnerabilityProduct":[{"id":"86387b5e-0bb8-377d-8bce-958c56538cd8","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"1.0.0, \u003c 2.4.0"}],"vulnerabilityVendor":[{"id":"aad205af-d4e7-39d1-b750-d36b61feb2a2","vendor":{"name":"go-vikunja"}}]}}],"enisaIdAdvisory":[]}