CVE-2026-28268 is a critical business logic vulnerability (CVSS 9.8) affecting Vikunja, an open-source self-hosted task management platform, in versions prior to 2.1.0. This flaw allows password reset tokens to be reused indefinitely due to improper invalidation and a cron job bug, enabling an attacker to perform a complete and persistent account takeover. The attack is network-based with low complexity, requiring no privileges or user interaction, and has high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.1.0CPE matchmatch criteria | cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.