https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T23:53:44.432682+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123530 fkie_cve-2026-123530 2026-11-10T23:53:44.434701+00:00

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.

 https://db.gcve.eu/vuln/ghsa-7jfp-xpw2-2j25 GHSA-7jfp-xpw2-2j25 2026-11-10T23:53:44.434773+00:00

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.