CVE-2026-35597 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja instances should assess exposure and apply the fix to prevent brute-force attacks against TOTP codes. This includes verifying the version of Vikunja being used, applying the patch (upgrading to version 2.3.0 or later), and implementing additional security measures such as rate limiting or IP blocking. Additionally, defenders should monitor for suspicious login activity and adjust security settings as needed to mitigate the

Why it matters

CVE-2026-35597 allows unlimited brute-force attempts against TOTP codes in Vikunja instances, increasing the risk of successful authentication. Defenders should verify exposure, apply the fix, and monitor for suspicious activity.

• Defenders must verify exposure and apply the fix to prevent brute-force attacks.
• The vulnerability allows for unlimited attempts against TOTP codes, increasing the risk of successful authentication.
• Defenders should monitor for suspicious login activity and adjust security settings as needed.

Technical summary

The vulnerability is caused by a database transaction handling bug in the login handler, which rolls back the database session after a TOTP validation failure. This prevents the account lockout mechanism from being triggered, allowing for unlimited brute-force attempts. The bug is located in the login handler of Vikunja, specifically in the pkg/routes/api/v1/login.go file. When a TOTP validation fails, the HandleFailedTOTPAuth function in pkg/user/totp.go increments an in-memory counter to track failed attempts. However, because the login handler always rolls back the database session after a TOTP failure, the account lockout mechanism, which is supposed to be triggered when the counter reaches 10, is never

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability allows for brute-force attacks against TOTP codes.

Recommended defensive actions

• Verify if the Vikunja instance is vulnerable by checking the version and applying the fix (upgrade to 2.3.0 or later)
• Implement additional security measures to prevent brute-force attacks, such as rate limiting or IP blocking
• Monitor for suspicious login activity and adjust security settings as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a database transaction handling bug in the login handler, which rolls back the database session after a TOTP validation failure. This prevents the account lockout mechanism from being triggered, allowing for unlimited brute-force attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.