What is GHSA-vvrr-xxjj-fc78?

GHSA-vvrr-xxjj-fc78 is a security advisory published by GitHub Security Advisories with High severity. Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows...

Which CVE IDs does GHSA-vvrr-xxjj-fc78 cover?

GHSA-vvrr-xxjj-fc78 covers the following CVE IDs: CVE-2026-123528. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vvrr-xxjj-fc78?

GHSA-vvrr-xxjj-fc78 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-vvrr-xxjj-fc78HighCVSS 6.8

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123528 →

📋 Description

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv
https://nvd.nist.gov/vuln/detail/CVE-2026-123528
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware
https://github.com/advisories/GHSA-vvrr-xxjj-fc78