{"id":"CVE-2026-28268","aliases":["GHSA-rfjg-6m84-crj2","GO-2026-4575"],"url":"https://o3.security/vulnerability/CVE-2026-28268","summary":"Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse","details":"Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.","published":"2026-02-27T20:16:29.842Z","modified":"2026-08-07T11:50:43.657506358Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"code.vikunja.io/api","fixedVersion":null}],"fix":{"url":"https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2","label":"go-vikunja/vikunja@5c2195f"},"references":[{"type":"WEB","url":"https://vikunja.io/changelog/vikunja-v2.1.0-was-released"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28268.json"},{"type":"ADVISORY","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rfjg-6m84-crj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28268"},{"type":"FIX","url":"https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:50:43.657506358Z"}}