CVE-2026-33473 — Improper Authentication in Vikunja

CWE-287 — Improper Authentication5 documents4 sources
Severity
5.7MEDIUMNVD
EPSS
0.0%
top 92.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
VikunjaGo-vikunja VikunjaCode.vikunja.io API
Timeline
Latest updateMar 23
PublishedMar 24

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages3 packages

▶NVDvikunja/vikunja0.13 — 2.2.1
▶CVEListV5go-vikunja/vikunja>= 0.13, < 2.2.1

🔴Vulnerability Details

3
OSV
Vikunja has TOTP Reuse During Validity Window in code.vikunja.io/api↗2026-03-23
▶
GHSA
Vikunja has TOTP Reuse During Validity Window↗2026-03-20
▶
OSV
Vikunja has TOTP Reuse During Validity Window↗2026-03-20
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33473 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶