Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Vikunja versions prior to 2.1.0 contain a business logic vulnerability in the password reset mechanism that allows password reset tokens to be reused indefinitely. The root cause involves two distinct logic errors. First, the ResetPassword function fails to invalidate the password reset token after use, instead deleting a different token type (TokenEmailConfirm) [2]. Second, the background cron job responsible for token cleanup contains an inverted comparison, deleting tokens newer than 24 hours instead of those older, so expiration is never enforced [2]. The combination means once a token is issued, it remains valid in the database forever.

Exploitation requires an attacker to obtain a single valid password reset token. This can occur through intercepting logs, browser history, or phishing [1][2]. No additional authentication is needed once the token is acquired. The attacker can use the token at any future time to submit a password reset request and change the victim's password. The vulnerability can be triggered remotely over the network, as the reset endpoint is accessible without prior authentication.

An attacker who successfully reuses a reset token gains complete and persistent control over the victim's account. This includes the ability to log in, view and modify all tasks and project data, and change further account settings. Since the account takeover persists until the legitimate owner manually reclaims it, it bypasses standard authentication controls and could be used for data exfiltration or privilege escalation within the application.

The issue has existed since version 0.18.0 (September 2021) and is fixed in Vikunja 2.1.0 [3]. Users should upgrade as soon as possible, especially those relying on Vikunja's own authentication rather than OAuth or LDAP. No workaround other than upgrading is available, and the advisory strongly encourages updating [3].