CVE-2026-35597— Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.3.0之前版本存在安全漏洞，该漏洞源于TOTP失败尝试锁定机制因数据库事务处理错误而失效，可能导致对TOTP代码进行无限暴力破解攻击。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-35597
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then unconditionally rolls back. HandleFailedTOTPAuth in pkg/user/totp.go uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone. The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time. This allows unlimited brute-force attempts against TOTP codes. This vulnerability is fixed in 2.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Vikunja 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vikunja是Vikunja开源的一个待办事项应用程序。 Vikunja 2.3.0之前版本存在安全漏洞，该漏洞源于TOTP失败尝试锁定机制因数据库事务处理错误而失效，可能导致对TOTP代码进行无限暴力破解攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | < 2.3.0 | - |
|
II. Public POCs for CVE-2026-35597
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-35597
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-35597 (2)
Vendor Advisories for CVE-2026-35597 (1)
Vendor Pages for CVE-2026-35597 (1)
-
Release v2.3.0 · go-vikunja/vikunja · GitHub x_refsource_MISC
Same Patch Batch · go-vikunja · 2026-04-10 · 11 CVEs total
| CVE-2026-35595 | 8.3 HIGH | Vikunja Affected by Privilege Escalation via Project Reparenting |
| CVE-2026-34727 | 7.4 HIGH | Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path |
| CVE-2026-35594 | 6.5 MEDIUM | Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission |
| CVE-2026-35599 | 6.5 MEDIUM | Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler |
| CVE-2026-35600 | 5.4 MEDIUM | Vikunja has HTML Injection via Task Titles in Overdue Email Notifications |
| CVE-2026-35602 | 5.4 MEDIUM | Vikunja has a File Size Limit Bypass via Vikunja Import |
| CVE-2026-35596 | 4.3 MEDIUM | Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug |
| CVE-2026-35598 | 4.3 MEDIUM | Vikunja has Missing Authorization on CalDAV Task Read |
| CVE-2026-40103 | 4.3 MEDIUM | Vikunja's Scoped API tokens with projects.background permission can delete project backgro |
| CVE-2026-35601 | 4.1 MEDIUM | Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output |
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
Same vendor: go-vikunja
-
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Has -
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via t -
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Param -
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API -
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API
Same weakness: CWE-307
-
CVE-2026-102825
Russh: Configured server auth-attempt cap is not enforced in -
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Prote -
CVE-2026-100678
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rat -
CVE-2026-100501
Flame through 2.4.0 Brute-Force Attack via Login Endpoint -
CVE-2026-49470
GLPI: Missing Rate Limiting on Login and TOTP Verification —
V. Comments for CVE-2026-35597
No comments yet