Description

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-15T16:17:54.087Z",
  "pubdate": "2026-09-15T16:17:54.087Z",
  "executiveSummary": "Vikunja versions prior to 2.6.0 contain a critical security vulnerability involving the absence of rate limiting mechanisms on public /api/v2 authentication and authorization endpoints.\nThe vulnerability encompasses login, registration, password-reset, and OAuth token retrieval routes, which are exposed to unauthenticated remote attackers.\nBy bypassing standard throttling controls, adversaries can conduct high-velocity brute-force attacks, credential stuffing, account enumeration, and denial-of-service via password-reset flooding.\nThis flaw significantly lowers the cost of unauthorized access attempts and data reconnaissance, posing a severe risk to user account integrity and platform availability.\nThe vulnerability is remotely exploitable without authentication, requiring only network connectivity to the target Vikunja instance.\nSuccessful exploitation allows attackers to bypass security boundaries intended to detect or block malicious automated traffic, enabling mass-scale abuse of authentication workflows.",
  "technicalDetails": "The core issue resides in the application's request processing middleware, which fails to enforce rate limiting policies on the /api/v2 API group. While internal or administrative endpoints may be protected, the critical authentication-related routes—specifically those handling user sessions and credential management—are omitted from the throttling configuration.\nThe affected endpoints include, but are not limited to, login, registration, password-reset, and OAuth token exchange. Because these endpoints lack server-side request rate monitoring, they are susceptible to automated, high-volume HTTP requests from a single source or distributed botnets.\nAn attacker can leverage this failure to perform credential guessing (brute-forcing) against registered accounts without fear of being blocked by the application. Furthermore, the absence of rate limiting on the registration and password-reset functions enables the automated creation of dummy accounts or the flooding of registered users with unsolicited password-reset emails, potentially leading to social engineering campaigns or resource exhaustion on the underlying mail transport infrastructure.\nThe exploitation flow begins with the attacker identifying the target Vikunja installation and isolating the /api/v2 endpoints. The attacker then initiates an automated script to transmit thousands of authentication requests per minute. Since the application does not validate request velocity or enforce cooldown periods, each request is processed by the backend until the underlying database or server resources reach a point of degradation or a successful credential match is discovered.\nAccount enumeration is particularly trivial here, as an attacker can observe the response codes or response times of the /api/v2/login or password-reset requests to differentiate between valid and invalid usernames. The absence of rate limiting allows for the systematic probing of the entire user database without triggering security alerts that would normally be associated with failed login attempts.\nThis is a flaw in the application's request handling logic where the security middleware responsible for traffic shaping is either not configured or not applied to the specific authentication controllers. The lack of protection ensures that even simple, scripted attacks can successfully compromise the integrity of the authentication process."
}