Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57458— Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Quick assessment

Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vikunja 是一款开源的自托管任务管理平台。在版本 2.3.0 中，一个仅限制为 权限的 scoped API token 可以调用 ，获取 OAuth 授权码，并在 将该授权码交换为普通的 bearer JSON Web Token (JWT) 和刷新令牌。由此生成的凭证不受原始 API token 权限的限制，允许以同一用户身份访问其声明范围之外的路由。该漏洞已在版本 2.4.0 中修复。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1199 · Trusted Relationship
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57458

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
go-vikunja vikunja = 2.3.0 -

II. Public POCs for CVE-2026-57458

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57458

请登录查看更多情报信息。

Vendor Pages for CVE-2026-57458 (1)

Other References for CVE-2026-57458 (2)

Same Patch Batch · go-vikunja · 2026-10-09 · 3 CVEs total

CVE-2026-62376 8.1 HIGH Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables acco
CVE-2026-62367 7.5 HIGH Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-accoun

IV. Related Vulnerabilities

Same product: vikunja
Same vendor: go-vikunja
Same weakness: CWE-269

V. Comments for CVE-2026-57458

No comments yet

Leave a comment