CVE-2026-28268 — AI Deep Analysis Summary

🚨 **Essence**: Vikunja < v2.1.0 has an **Authorization Issue**. Password reset tokens can be **reused indefinitely**. 📉 **Consequences**: Leads to **Account Takeover (ATO)**.…

🛡️ **Root Cause**: **CWE-459** (Incomplete Cleanup). The system fails to invalidate or expire password reset tokens after use. 🐛 **Flaw**: Lack of one-time-use enforcement or strict expiration logic for recovery tokens.

👥 **Affected**: **Vikunja** (Open-source To-Do App). 📦 **Versions**: All versions **prior to 2.1.0**. 🏢 **Vendor**: go-vikunja. If you are running an older self-hosted instance, you are at risk.

💀 **Attacker Actions**: Full **Account Takeover**. 📂 **Data Access**: Read/Write all tasks, projects, and personal data. 🔑 **Privileges**: Gain full administrative control over the victim's Vikunja account.…

⚡ **Exploitation Threshold**: **LOW**. 🌐 **Network**: Attack Vector is **Network** (Remote). 🔒 **Auth**: **None** required to trigger/reset. 🖱️ **UI**: **None** required. Simple, automated exploitation is possible.

🔓 **Public Exploit**: **No** specific PoC/Wild Exploit listed in data. 📝 **References**: GitHub commit and Security Advisory (GHSA-rfjg-6m84-crj2) confirm the flaw.…

🔍 **Self-Check**: 1. Check your Vikunja version. 2. If < v2.1.0, you are vulnerable. 3. Monitor logs for repeated password reset requests for the same user. 4.…

✅ **Fixed**: **Yes**. 📅 **Patch Date**: Released in **Vikunja v2.1.0** (Feb 27, 2026). 🔗 **Action**: Upgrade immediately to v2.1.0 or later. See GitHub commit for details.

🚧 **No Patch Workaround**: 1. **Disable** password reset functionality if possible. 2. **Monitor** token usage closely. 3. **Shorten** token expiration times in config (if configurable). 4.…

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. CVSS 9.8 means immediate action required. Remote, unauthenticated, high impact. Patch now to prevent account hijacking.