Medium severity6.8NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-123497

Description

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

Affected products

Go Vikunja/Vikunjallm-fuzzy
Range: <2.7.1

Patches

Vulnerability mechanics

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qxnvd
www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discoverynvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000