Dashboard / CVE-2026-123497

CVE-2026-123497

HIGH
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-11-08 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Passive
S: X
AT: Present
VC: High
VI: High
VA: None

Description

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
go-vikunja vikunja 0 < 2.7.1

References & Advisories (2)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ No authentication

CVSS Score

7.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.16%
Raw Score 0.001580
Percentile 5.0%
Date 2026-11-08

Intelligence Sources

mitre ref →
nvd ref →

External Links