CVE-2026-123497

EUVD-2026-119382
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.97%
Common Weakness Enumeration
References
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx
https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery