CVE-2026-91982: Go-Vikunja Vikunja

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

Affected products

• Go-Vikunja Vikunja: before 2.6.0 (fixed in 2.6.0)

Published 2026-09-15. Last modified 2026-09-17.