CVE-2026-62376: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords.
References
- github.com/advisories/GHSA-r6w9-259g-gwrv
- github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323
- github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d
- github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85
- github.com/go-vikunja/vikunja/releases/tag/v2.4.0
- github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv
- nvd.nist.gov/vuln/detail/CVE-2026-62376
Code Behaviors & Features
Detect and mitigate CVE-2026-62376 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →