https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 04:22:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-91973 <p>Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance&#39;s anti-brute-force controls and compromise password-only accounts.</p> <p>Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance&#39;s anti-brute-force controls and compromise password-only accounts.</p> https://db.gcve.eu/vuln/fkie_cve-2026-91973 https://db.gcve.eu/vuln/ghsa-m469-88xx-8rx2 <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.</p> <p>### Details `pkg/routes/routes.go` (~lines 238-249) registers `/.well-known`, `/dav`, and `/feeds` with `middleware.BasicAuth(...)` and nothing else; `registerCalDavRoutes` adds no limiter. `pkg/routes/caldav/auth.go` (~lines 88-93) falls through to `user.CheckUserCredentials` with the plain account password when no CalDAV token matches. In contrast, `/register`, `/login`, etc. are wrapped by `unauthRateLimit()` — an unconditional 10/min/IP pre-auth floor that ignores `ratelimit.enabled` (default false).</p> <p>TOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.</p> <p>### PoC (verified at runtime against v2.5.0) ``` POST /api/v1/login x25 wrong passwords -&gt; 429 from attempt 2 (throttled) PROPFIND /dav/principals/{user}/ x60 wrong passwords -&gt; 401 x60, 429 x0 GET /feeds/notifications.atom x30 wrong passwords -&gt; 401 x30, 429 x0 PROPFIND /dav/... with correct password -&gt; 207 (proves the 401s are real auth failures) ```</p> <p>### Impact The anti-brute-force floor guarding `/login` is entirely absent on `/dav`, `/feeds`, and `/.well-known`, giving an u…</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.</p> <p>### Details `pkg/routes/routes.go` (~lines 238-249) registers `/.well-known`, `/dav`, and `/feeds` with `middleware.BasicAuth(...)` and nothing else; `registerCalDavRoutes` adds no limiter. `pkg/routes/caldav/auth.go` (~lines 88-93) falls through to `user.CheckUserCredentials` with the plain account password when no CalDAV token matches. In contrast, `/register`, `/login`, etc. are wrapped by `unauthRateLimit()` — an unconditional 10/min/IP pre-auth floor that ignores `ratelimit.enabled` (default false).</p> <p>TOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.</p> <p>### PoC (verified at runtime against v2.5.0) ``` POST /api/v1/login x25 wrong passwords -&gt; 429 from attempt 2 (throttled) PROPFIND /dav/principals/{user}/ x60 wrong passwords -&gt; 401 x60, 429 x0 GET /feeds/notifications.atom x30 wrong passwords -&gt; 401 x30, 429 x0 PROPFIND /dav/... with correct password -&gt; 207 (proves the 401s are real auth failures) ```</p> <p>### Impact The anti-brute-force floor guarding `/login` is entirely absent on `/dav`, `/feeds`, and `/.well-known`, giving an u…</p> https://db.gcve.eu/vuln/ghsa-m469-88xx-8rx2