CVE-2026-34727

OVERVIEW: CVE-2026-34727 is a critical authentication bypass vulnerability in Vikunja, an open-source self-hosted task management platform, affecting versions prior to 2.3.0. The vulnerability exists in the OIDC (OpenID Connect) callback handler, which fails to verify whether matched users have TOTP two-factor authentication enabled. When users are matched via OIDC email fallback, the second authentication factor is completely bypassed, allowing attackers to gain unauthorized access to accounts that should be protected by multi-factor authentication. SEVERITY: This vulnerability carries a CVSS 3.1 score of 9.1 (CRITICAL) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is severe, with high confidentiality and integrity compromise possible, though availability is not directly affected. The vulnerability demonstrates how OIDC integration can introduce gaps in existing security controls, particularly affecting users who have explicitly enabled TOTP protection. EXPLOITATION STATUS: The vulnerability is currently inactive on public exploit databases and is not included in CISA's Known Exploited Vulnerabilities catalog. However, the relatively modest EPSS score of 0.000430 and FAUCET Risk Score of 43.0 suggest limited real-world exploitation activity. Organizations operating Vikunja instances prior to version 2.3.0 should prioritize patching to prevent potential credential-based attacks that could compromise sensitive task and project data.