https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:51:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274129 EUVD-2026-274129 https://cve.radiocsirt.org/vuln/euvd-2026-274129 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28268 <p>Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.</p> <p>Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28268 https://cve.radiocsirt.org/vuln/ghsa-rfjg-6m84-crj2 <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>**Summary** A critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.</p> <p>This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.</p> <p>**Technical Analysis** The vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.</p> <p>1. Logic Error in Password Reset (No Invalidation) In pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user&#39;s password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.</p> <p>Vulnerable Code: pkg/user/user_password_reset.go (Lines 36-94) ``` func ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) { // ... [Validation and User Lookup] ...</p> <p>// Hash the password user.Password, err = HashPassword(reset.NewPassword) if err != nil { return }</p> <p>// FLAW: Deletes &#39;TokenEmailConfirm&#39; instead of the current &#39;TokenPasswordReset&#39; err = removeTokens(s, user, TokenEmailConfirm) if err != nil { return }…</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>**Summary** A critical business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever.</p> <p>This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls.</p> <p>**Technical Analysis** The vulnerability stems from two distinct logic errors in the pkg/user/ package that confirm the tokens are never removed.</p> <p>1. Logic Error in Password Reset (No Invalidation) In pkg/user/user_password_reset.go, the ResetPassword function successfully updates the user&#39;s password but fails to delete the reset token used to authorize the request. Instead, it attempts to delete a TokenEmailConfirm token, leaving the TokenPasswordReset active.</p> <p>Vulnerable Code: pkg/user/user_password_reset.go (Lines 36-94) ``` func ResetPassword(s *xorm.Session, reset *PasswordReset) (userID int64, err error) { // ... [Validation and User Lookup] ...</p> <p>// Hash the password user.Password, err = HashPassword(reset.NewPassword) if err != nil { return }</p> <p>// FLAW: Deletes &#39;TokenEmailConfirm&#39; instead of the current &#39;TokenPasswordReset&#39; err = removeTokens(s, user, TokenEmailConfirm) if err != nil { return }…</p> https://cve.radiocsirt.org/vuln/ghsa-rfjg-6m84-crj2