CVE-2026-33473
Last modified
CVE-2026-33473 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vikunja | Vikunja | >= 0.13, < 2.2.1 |
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p747-qc5p-773rExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33473?
How severe is CVE-2026-33473?
How do I fix CVE-2026-33473?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33468Kysely is a type-safe TypeScript SQL query builder. Prior to…8.1
- CVE-2026-33469Frigate is a network video recorder (NVR) with realtime loca…6.5
- CVE-2026-3347The Multi Functional Flexi Lightbox plugin for WordPress is …5.5
- CVE-2026-33470Frigate is a network video recorder (NVR) with realtime loca…4.3
- CVE-2026-33471nimiq-block contains block primitives to be used in Nimiq's …9.6
- CVE-2026-33472Cryptomator is an open-source client-side encryption applica…4.8
- CVE-2026-33474Vikunja is an open-source self-hosted task management platfo…6.5
- CVE-2026-33475Langflow is a tool for building and deploying AI-powered age…9.1
- CVE-2026-33476SiYuan is a personal knowledge management system. Prior to v…7.5
- CVE-2026-33477FileRise is a self-hosted web-based file manager with multi-…4.3
- CVE-2026-33478WWBN AVideo is an open source video platform. In versions up…10
- CVE-2026-33479WWBN AVideo is an open source video platform. In versions up…8.8
Are you affected by CVE-2026-33473?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST