Vikunja: Scoped API token can obtain unrestricted OAuth session credentials
Summary
Vikunja 2.3.0 allows an API token limited to the oauth.authorize permission to call the OAuth authorization and token endpoints. The token can be exchanged for a normal bearer JWT and refresh token that are not restricted by the original token's scope. An attacker with such a token can access routes outside its declared scope as the same user. The attack requires network access to the instance and an existing token with the authorize scope.
Affected
- Vikunja 2.3.0
- Versions before 2.3.0: Unknown.
Fixed in
- Vikunja 2.4.0 (fix commit 4ae2e093014881052ed8f8ecd8bcb9adf83dd276)
Workaround
- No vendor workaround documented.
- Until patched, review and revoke API tokens with the oauth.authorize scope and check whether any integration needs it.
Exploitation
- No evidence of in-the-wild exploitation and no public proof of concept found.
- CISA SSVC lists exploitation as poc and automatable as no.
- CISA KEV status not verified.
Our recommendation
- Upgrade Vikunja to 2.4.0 or later, prioritising internet-facing instances and instances whose tokens are shared with third-party tools.
- Review and revoke API tokens carrying the oauth.authorize scope.
- Treat sessions issued before patching as valid until verified; check for unexpected access to the account.
- Monitor logs for calls to /api/v1/oauth/authorize and /api/v1/oauth/token.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v3p6-34mc-hj7v github.com
- Vikunja v2.4.0 release github.com
- Fix commit 4ae2e09 github.com
- OSV CVE-2026-57458 osv.dev
- Vikunja 2.4.0 changelog vikunja.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:22.
Original description (NVD)
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.