What is CVE-2026-91982?

CVE-2026-91982 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Insufficiently Protected Credentials. CVSS score: 4.3/10. Published 2026-09-15.

How severe is CVE-2026-91982?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Go-Vikunja Vikunja

CVE-2026-91982

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Go-vikunja Vikunja

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91982?: CVE-2026-91982 is a medium-severity vulnerability in Go-Vikunja Vikunja, classified under Insufficiently Protected Credentials. CVSS score: 4.3/10. Published 2026-09-15.
How severe is CVE-2026-91982?: Medium severity. CVSS v3 base score is 4.3 out of 10.