{"id":"CVE-2026-123513","aliases":[],"cve":{"records":[{"id":"CVE-2026-123513","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:46:28.480Z","published":"2026-11-08T01:37:25.882Z","modified":"2026-11-10T17:59:59.119Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:25.882Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T17:59:59.119Z"}],"references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj93-wmch-2crq","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-auth-token-leak-via-api-url-change","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.7.1"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T16:25:56.714602Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Vikunja before 2.7.1 Auth Token Leak via API URL Change","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.","score":7.6,"severity":"high","published":"2026-11-08T01:37:25.882Z","modified":"2026-11-10T17:59:59.119Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"go-vikunja","name":"vikunja","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.7.1","versionType":"semver"},{"version":"2.7.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/code.vikunja.io/api","packageIdentity":{"ecosystem":"Go","name":"code.vikunja.io/api"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123513"}],"remediation":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj93-wmch-2crq","https://www.vulncheck.com/advisories/vikunja-before-2.7.1-auth-token-leak-via-api-url-change"],"sources":[{"name":"CVE","id":"CVE-2026-123513","modified":"2026-11-10T17:59:59.119Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123513"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-10T18:16:08.711Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T04:55:31.932Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T04:00:45.620Z","attemptedAt":"2026-11-08T04:00:45.620Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-08T04:00:39.860Z","attemptedAt":"2026-11-08T04:00:39.860Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T04:00:39.709Z","attemptedAt":"2026-11-08T04:00:39.709Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T04:00:38.812Z","attemptedAt":"2026-11-08T04:00:38.812Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-119398","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119398","modified":"Nov 8, 2026, 1:37:25 AM","score":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T04:00:39.709Z"},{"source":"GitHub Advisory Database","id":"GHSA-h52v-3vxf-m2vc","url":"https://github.com/advisories/GHSA-h52v-3vxf-m2vc","modified":"2026-11-08T03:30:34Z","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-11-08T04:00:39.860Z"},{"source":"NVD","id":"CVE-2026-123513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123513","modified":"2026-11-08T02:16:40.140","score":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T04:00:45.620Z"},{"source":"NVD","id":"CVE-2026-123513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123513","modified":"2026-11-08T02:16:40.140","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","checkedAt":"2026-11-08T04:00:45.620Z"}],"aiSummary":{"text":"Vikunja before 2.7.1 has a credential exposure vulnerability, allowing attackers to steal auth tokens by changing the frontend API URL. The attacker must induce users to switch the API URL. This exposes the bearer token and desktop OAuth refresh token.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:31:24.313Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123513"}]}}