CVE-2026-91973 — Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue…
Published: 2026-09-15 · CVSS: 8.7 · CVSS 4.0
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7