CVE-2026-34727 go-vikunja CVE debrief

Who should care

Defenders and administrators of Vikunja instances, especially those with TOTP two-factor authentication enabled, should assess their exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the vulnerability's impact on their systems and take appropriate actions to secure their Vikunja instances.

Why it matters

CVE-2026-34727 is a high-severity vulnerability in Vikunja that allows skipping TOTP two-factor authentication under certain conditions, potentially leading to unauthorized access. Defenders should prioritize verifying exposure and remediation for Vikunja instances, especially those with TOTP two-factor authentication enabled.

• Potential skipping of TOTP two-factor authentication for local users with TOTP enrolled.
• Possible unauthorized access to Vikunja instances with vulnerable versions.

Technical summary

The OIDC callback handler in Vikunja issues a full JWT token without checking if the matched user has TOTP two-factor authentication enabled. This allows skipping the second factor when a local user with TOTP enrolled is matched via the OIDC email fallback mechanism. The issue was fixed in version 2.3.0. Affected Vikunja instances, especially those with TOTP two-factor authentication enabled, are at risk of unauthorized access. Defenders should prioritize verifying exposure and remediation for these instances, and assess the impact of this vulnerability on their systems.

Defensive priority

Defenders should prioritize verifying exposure and remediation for Vikunja instances, especially those with TOTP two-factor authentication enabled, and assess the impact of this vulnerability on their systems.

Recommended defensive actions

• Verify if your Vikunja instance is vulnerable by checking the version and configuration.
• Assess the impact of this vulnerability on your systems, especially if TOTP two-factor authentication is enabled.
• Consider upgrading to version 2.3.0 or later to fix the issue.
• Review and update your authentication and authorization settings to ensure secure access to your Vikunja instance.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the fixed version. The vendor advisory from GitHub also provides additional context on the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.