What is GHSA-rg35-8p7r-mq2v?

GHSA-rg35-8p7r-mq2v is a security advisory published by GitHub Security Advisories with High severity. Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that...

Which CVE IDs does GHSA-rg35-8p7r-mq2v cover?

GHSA-rg35-8p7r-mq2v covers the following CVE IDs: CVE-2026-123497. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rg35-8p7r-mq2v?

GHSA-rg35-8p7r-mq2v has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-rg35-8p7r-mq2vHighCVSS 6.8

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123497 →

📋 Description

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx
https://nvd.nist.gov/vuln/detail/CVE-2026-123497
https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery
https://github.com/advisories/GHSA-rg35-8p7r-mq2v