CVE-2026-91973 in Vikunja
Summary
by MITRE • 09/15/2026
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.