CVE-2026-28268

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

• CWE-459
• CWE-640
• CWE-640

• https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2Patch
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rfjg-6m84-crj2Vendor Advisory
• https://vikunja.io/changelog/vikunja-v2.1.0-was-releasedRelease Notes

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28261Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and D…5.5
• CVE-2026-28262Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Im…6
• CVE-2026-28263Dell PowerProtect Data Domain with Data Domain Operating Sys…4.8
• CVE-2026-28264Dell PowerProtect Agent Service, version(s) prior to 20.1, c…5.5
• CVE-2026-28265PowerStore, contains a Path Traversal vulnerability in the S…7.1
• CVE-2026-28267Multiple i-フィルター products are configured with improper file …6.8
• CVE-2026-28269Kiteworks is a private data network (PDN). Prior to version …8.8
• CVE-2026-2827The Open User Map PRO plugin for WordPress is vulnerable to …4.7
• CVE-2026-28270Kiteworks is a private data network (PDN). Prior to version …7.2
• CVE-2026-28271Kiteworks is a private data network (PDN). Prior to version …6.5
• CVE-2026-28272Kiteworks is a private data network (PDN). Prior to version …4.8
• CVE-2026-28274Initiative is a self-hosted project management platform. Ver…8.7