https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 21:00:53 +0000 https://db.gcve.eu/vuln/cve-2026-123495 <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker&#39;s credentials or OIDC code, switching the victim into the attacker&#39;s account and exposing data the victim then adds.</p> <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker&#39;s credentials or OIDC code, switching the victim into the attacker&#39;s account and exposing data the victim then adds.</p> https://db.gcve.eu/vuln/cve-2026-123495