CVE-2026-34727: Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
The OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped.
References
- github.com/advisories/GHSA-8jvc-mcx6-r4cg
- github.com/go-vikunja/vikunja
- github.com/go-vikunja/vikunja/commit/b642b2a4536a3846e627a78dce2fdd1be425e6a1
- github.com/go-vikunja/vikunja/pull/2582
- github.com/go-vikunja/vikunja/releases/tag/v2.3.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6-r4cg
- nvd.nist.gov/vuln/detail/CVE-2026-34727
Code Behaviors & Features
Detect and mitigate CVE-2026-34727 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →