CVSS 3.1
5.7 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NCVE-2026-33473
Medium (5.7) in vikunja vikunja. EPSS 0.3% chance of exploitation in the next 30 days.
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vikunja:vikunja
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p747-qc5p-773r | Go | code.vikunja.io/api | >=0.13 | no fix published |
| GO-2026-4805 | Go | code.vikunja.io/api | all versions | no fix published |