{"id":"CVE-2026-91973","aliases":["EUVD-2026-78649","GHSA-m469-88xx-8rx2","GHSA-p2vv-wrh8-x466","GO-2026-6737"],"status":"published","title":"Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00672,"percentile":0.52361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-307"],"published":"2026-09-15T15:18:23Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Go","package":"code.vikunja.io/api","fixed_in":["2.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"go-vikunja","product":"vikunja"}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91973","tags":["advisory"]},{"url":"https://github.com/go-vikunja/vikunja/pull/3688","tags":["web"]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m469-88xx-8rx2"},{"url":"https://github.com/advisories/GHSA-p2vv-wrh8-x466"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91973.json","tags":["advisory"]},{"url":"https://github.com/go-vikunja/vikunja","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-91973","title":"Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"published","published":"2026-09-15T15:18:23.488Z","modified":"2026-09-15T15:55:04.161Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:19:53.115938Z"}],"euvd":[{"id":"EUVD-2026-78649","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"published","published":"2026-09-15T15:18:23Z","modified":"2026-09-15T15:55:04Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:17.768191Z"}],"ghsa":[{"id":"GHSA-p2vv-wrh8-x466","title":"Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m469-88xx-8rx2. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"withdrawn","published":"2026-09-15T18:32:30Z","modified":"2026-10-09T20:51:58Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:41:31.175024Z"},{"id":"GHSA-m469-88xx-8rx2","title":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","description":"### Summary\nThe `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.\n\n### Details\n`pkg/routes/routes.go` (~lines 238-249) registers `/.well-known`, `/dav`, and `/feeds` with `middleware.BasicAuth(...)` and nothing else; `registerCalDavRoutes` adds no limiter. `pkg/routes/caldav/auth.go` (~lines 88-93) falls through to `user.CheckUserCredentials` with the plain account password when no CalDAV token matches. In contrast, `/register`, `/login`, etc. are wrapped by `unauthRateLimit()` — an unconditional 10/min/IP pre-auth floor that ignores `ratelimit.enabled` (default false).\n\nTOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.\n\n### PoC (verified at runtime against v2.5.0)\n```\nPOST /api/v1/login  x25 wrong passwords  -\u003e 429 from attempt 2 (throttled)\nPROPFIND /dav/principals/{user}/  x60 wrong passwords  -\u003e 401 x60, 429 x0\nGET /feeds/notifications.atom  x30 wrong passwords  -\u003e 401 x30, 429 x0\nPROPFIND /dav/... with correct password -\u003e 207 (proves the 401s are real auth failures)\n```\n\n### Impact\nThe anti-brute-force floor guarding `/login` is entirely absent on `/dav`, `/feeds`, and `/.well-known`, giving an unbounded credential-guessing surface against account passwords. (bcrypt caps throughput to a few guesses/second, but nothing caps the number of attempts.) Reported as an authentication-control bypass, not a DoS.\n\n### Fix\nApply the unconditional pre-auth rate-limit floor to the `/dav`, `/.well-known`, and `/feeds` groups.","status":"published","published":"2026-10-09T20:52:04Z","modified":"2026-10-09T20:52:06Z","cwes":["CWE-307"],"updated_at":"2026-11-02T14:41:31.175024Z"}],"nvd":[{"id":"CVE-2026-91973","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"published","published":"2026-09-15T16:17:54.23Z","modified":"2026-09-16T20:16:09.343Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-91973","title":"Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth","description":"Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"published","published":"2026-09-15T15:18:23.488Z","modified":"2026-10-28T02:30:51.699821502Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"GHSA-p2vv-wrh8-x466","title":"Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m469-88xx-8rx2. This link is maintained to preserve external references.\n\n### Original Description\nVikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.","status":"withdrawn","published":"2026-09-15T18:32:30Z","modified":"2026-10-09T21:00:06.980684841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-307"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GHSA-m469-88xx-8rx2","title":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","description":"### Summary\nThe `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.\n\n### Details\n`pkg/routes/routes.go` (~lines 238-249) registers `/.well-known`, `/dav`, and `/feeds` with `middleware.BasicAuth(...)` and nothing else; `registerCalDavRoutes` adds no limiter. `pkg/routes/caldav/auth.go` (~lines 88-93) falls through to `user.CheckUserCredentials` with the plain account password when no CalDAV token matches. In contrast, `/register`, `/login`, etc. are wrapped by `unauthRateLimit()` — an unconditional 10/min/IP pre-auth floor that ignores `ratelimit.enabled` (default false).\n\nTOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.\n\n### PoC (verified at runtime against v2.5.0)\n```\nPOST /api/v1/login  x25 wrong passwords  -\u003e 429 from attempt 2 (throttled)\nPROPFIND /dav/principals/{user}/  x60 wrong passwords  -\u003e 401 x60, 429 x0\nGET /feeds/notifications.atom  x30 wrong passwords  -\u003e 401 x30, 429 x0\nPROPFIND /dav/... with correct password -\u003e 207 (proves the 401s are real auth failures)\n```\n\n### Impact\nThe anti-brute-force floor guarding `/login` is entirely absent on `/dav`, `/feeds`, and `/.well-known`, giving an unbounded credential-guessing surface against account passwords. (bcrypt caps throughput to a few guesses/second, but nothing caps the number of attempts.) Reported as an authentication-control bypass, not a DoS.\n\n### Fix\nApply the unconditional pre-auth rate-limit floor to the `/dav`, `/.well-known`, and `/feeds` groups.","status":"published","published":"2026-10-09T20:52:04Z","modified":"2026-10-19T21:40:52.604317649Z","cwes":["CWE-307"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"GO-2026-6737","title":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api","description":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","status":"published","published":"2026-10-19T21:08:26Z","modified":"2026-10-19T21:31:35.964761967Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}