CVE-2026-33315— Vikunja has a 2FA Bypass via Caldav Basic Auth
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.2.0之前版本存在安全漏洞，该漏洞源于Caldav端点允许使用基本身份验证登录，可能导致用户绕过启用了双因素认证的账户的TOTP。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33315
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja has a 2FA Bypass via Caldav Basic Auth
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Vikunja 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.2.0之前版本存在安全漏洞，该漏洞源于Caldav端点允许使用基本身份验证登录，可能导致用户绕过启用了双因素认证的账户的TOTP。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | < 2.2.0 | - |
|
II. Public POCs for CVE-2026-33315
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33315
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-33315 (1)
Vendor Advisories for CVE-2026-33315 (1)
-
2FA Bypass via Caldav Basic Auth · Advisory · go-vikunja/vikunja · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-33315 (1)
Same Patch Batch · go-vikunja · 2026-03-24 · 16 CVEs total
| CVE-2026-33316 | 8.1 HIGH | Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablem |
| CVE-2026-33678 | 8.1 HIGH | Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
| CVE-2026-33680 | 7.5 HIGH | Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission E |
| CVE-2026-33474 | 6.5 MEDIUM | Vikunja Affected by DoS via Image Preview Generation |
| CVE-2026-33677 | 6.5 MEDIUM | Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API |
| CVE-2026-33676 | 6.5 MEDIUM | Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorizatio |
| CVE-2026-33675 | 6.4 MEDIUM | Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Int |
| CVE-2026-33679 | 6.4 MEDIUM | Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections |
| CVE-2026-33473 | 5.7 MEDIUM | Vikunja has TOTP Reuse During Validity Window |
| CVE-2026-33313 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments | |
| CVE-2026-33335 | Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openEx | |
| CVE-2026-33334 | Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegratio | |
| CVE-2026-33336 | Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation | |
| CVE-2026-33668 | Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and O | |
| CVE-2026-33700 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Projec |
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API
Same vendor: go-vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
Same weakness: CWE-288
-
CVE-2026-100518
WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken -
CVE-2026-39793
WordPress Simple JWT Login plugin 4.0.0 - Broken Authenticat -
CVE-2026-39769
WordPress Graphina plugin <= 3.1.12 - Broken Authentication -
CVE-2026-100261
JetBrains YouTrack 2026.2.18991前权限绕过漏洞 -
CVE-2026-63493
Snipe-IT: 2FA bypass via the API token flow
V. Comments for CVE-2026-33315
No comments yet