Medium severity5.9NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026
CVE-2026-123499
CVE-2026-123499
Description
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.7.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.