CVE-2026-91972 in Vikunja
Summary
by MITRE • 09/15/2026
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability in Vikunja versions prior to 2.6.0 represents a critical failure in implementing access control mechanisms specifically regarding rate limiting on public-facing authentication endpoints. This flaw affects the /api/v2 interface, which serves as the primary entry point for user interactions such as login attempts, account registration, password reset requests, and OAuth token generation. By omitting throttling controls on these specific routes, the application exposes itself to automated abuse where remote unauthenticated actors can send an unlimited volume of requests without encountering any resistance or delay from the server infrastructure. This absence of rate limiting fundamentally undermines the security posture by allowing attackers to bypass standard defensive measures designed to mitigate brute-force and denial-of-service style attacks against authentication systems.
From a technical perspective, the core issue lies in the middleware configuration that handles HTTP request processing for these endpoints. Typically, web applications employ middleware layers to inspect incoming requests and enforce policies such as maximum attempts per minute or IP-based throttling. In this case, those protective rules were either not applied or incorrectly scoped within the application logic, leaving the authentication flows wide open. Consequently, an attacker can script automated tools to iterate through vast lists of usernames and passwords with minimal latency. This capability facilitates unbounded credential guessing attacks where attackers systematically test common password combinations against known user accounts. Furthermore, because there is no limit on how many times a single IP address or even different IPs can attempt authentication within a short timeframe, the system becomes highly susceptible to account enumeration techniques that rely on analyzing response time differences or error messages to determine valid usernames.
The operational impact of this vulnerability extends beyond simple credential compromise. The lack of throttling enables password-reset flooding attacks, where an attacker triggers numerous reset emails for specific targets. This not only wastes administrative resources and email server capacity but also serves as a distraction technique or a method to harass users by inundating their inboxes with suspicious activity alerts. Additionally, the ability to perform rapid OAuth token requests can lead to resource exhaustion on downstream identity providers if they are similarly vulnerable or lack robust rate limiting themselves. The cumulative effect of these attacks is a significant degradation of service availability and integrity, as well as a high probability of unauthorized access resulting from successful brute-force attempts against weakly secured accounts.
This vulnerability aligns with several established industry standards for categorizing security flaws. It maps directly to CWE-307 Improper Restriction of Excessive Authentication Attempts, which describes the failure to limit or monitor authentication failures. Additionally, it relates to CWE-284 Access Control: Improper Access Control when considering the broader context of failing to restrict access based on request frequency and volume. In terms of offensive security tactics, this flaw facilitates techniques described in MITRE ATT&CK under T1110 Brute Force, specifically sub-techniques such as T1110.001 Password Guessing and T1110.003 Credential Stuffing. The ability to enumerate accounts also correlates with T1078 Valid Accounts if the attacker successfully gains foothold through these methods.
To mitigate this vulnerability, organizations running Vikunja versions before 2.6.0 should immediately upgrade to version 2.6.0 or later where rate limiting has been properly implemented for all public authentication endpoints. For environments that cannot be upgraded instantly due to operational constraints, temporary mitigations include deploying a Web Application Firewall (WAF) in front of the Vikunja instance to enforce strict request rates per IP address on paths matching /api/v2/auth/* or similar patterns. Administrators should also configure reverse proxies like Nginx or Apache with rate-limiting modules such as limit_req_zone to cap the number of requests allowed from a single client within a defined time window. Implementing CAPTCHA challenges after a small threshold of failed login attempts can further deter automated scripts without significantly impacting legitimate user experience. Regular security audits and penetration testing should be conducted to ensure that authentication endpoints remain resilient against abuse, adhering to best practices outlined in OWASP guidelines for preventing brute-force attacks.