External risk intelligence

Vikunja OIDC Callback Bypasses Two-Factor Authentication.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-34727

Vikunja is a self-hosted task management platform typically deployed as a web application. Such platforms are commonly exposed to the internet to allow remote access for users, making the OIDC callback handler and authentication endpoints directly reachable in standard deployment patterns.

Authentication Bypass

Vikunja

before 2.3.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Vikunja self-hosted task management platform that could allow unauthorized access to user accounts. The issue arises from an incomplete check during the authentication process, specifically when using OIDC with email fallback for users who have two-factor authentication enabled, effectively bypassing the second security step.

Bypasses two-factor authentication.
Affects task management account access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into initiating an OIDC login flow. If the user's account has two-factor authentication enabled, the system would incorrectly bypass this second security step during the OIDC callback, granting the attacker access to the user's account.

Unauthenticated access to OIDC callback handler.
OIDC callback skips two-factor authentication.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass multi-factor authentication when logging in via OpenID Connect. This could lead to unauthorized access to user accounts and their associated data within the Vikunja platform, under specific conditions where OIDC is used as an authentication fallback for local users with TOTP enabled.

User account access.
OIDC fallback bypass.
Unauthorized account access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Vikunja instances where OIDC is configured with email fallback. Application owners and platform teams are responsible for identifying and securing these deployments. The first step is to locate all Vikunja instances, confirm OIDC and email fallback configurations, and assess business criticality to prioritize remediation.

Identify Vikunja OIDC instances.
Verify OIDC email fallback configuration.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Vikunja?

Vikunja is an open-source, self-hosted platform designed for task management and organization. Users typically host this software on their own infrastructure to manage projects, create to-do lists, and track tasks. Because it is self-hosted, administrators have full control over the application's configuration, including how users log in and secure their accounts.

What does CWE-287 mean for CVE-2026-34727?

CWE-287 refers to Improper Authentication. In the context of CVE-2026-34727, this means the software fails to correctly verify the identity of a user during the login process. Specifically, the system grants a valid session token without confirming the second factor, even when that security measure is mandatory for the user account.

How can an attacker trigger this authentication bypass?

The flaw occurs when the OIDC (OpenID Connect) callback handler completes a login for a user who has TOTP two-factor authentication enabled. It does not trigger if OIDC is disabled, or if the user does not have TOTP enabled. The issue specifically manifests during the OIDC email fallback mechanism, which mistakenly skips the secondary verification step.

Is my instance affected by this CVE?

Halo Surface Signal indicates that Vikunja is frequently deployed as an internet-facing web application. If your instance is reachable from the internet and utilizes OIDC with email fallback, it is more likely to be exposed to this authentication flaw. You should prioritize checking these specific configurations.

What is the first step to remediate this issue?

You should verify if your Vikunja version is prior to 2.3.0, as this version contains the fix for the authentication logic. Review your current authentication settings to determine if OIDC with email fallback is active. If so, plan to update the software to version 2.3.0 or later to ensure that multi-factor authentication is correctly enforced for all users.

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.