CVE-2026-91972

Vikunja, an open-source self-hosted task management application, fails to apply rate limiting to public /api/v2 authentication endpoints in all versions before 2.6.0, including login, register, password-reset, and OAuth token routes. A remote unauthenticated attacker can trigger these endpoints without any throttling, enabling unbounded password guessing (brute force and credential stuffing), account enumeration, and password-reset flooding. Successful credential guessing yields full account takeover of user task lists and any data those accounts can access, and reset flooding can spam users' email inboxes or enable targeted account abuse. Administrators running self-hosted Vikunja instances below 2.6.0 with internet-reachable API endpoints are affected. No public proof-of-concept is known and there is no evidence of in-the-wild exploitation to date.

What to do: Upgrade Vikunja to version 2.6.0 or later, which applies rate limiting to the affected /api/v2 authentication endpoints. If upgrading is delayed, enforce rate limits at the reverse proxy or edge (e.g., nginx limit_req, fail2ban, or a WAF rule) covering login, register, password-reset, and OAuth token routes, and restrict API exposure to trusted networks or VPN where possible. Review authentication logs for spikes in failed logins or password-reset requests, enable MFA for user accounts, and rotate credentials for any accounts showing successful logins from anomalous sources.