CVE-2026-62367

Executive Summary

CVE-2026-62367 is an improper authentication vulnerability in the Vikunja open-source, self-hosted task management platform affecting versions 1.0.0 through 2.3.0. When an administrator enables the per-provider emailfallback option on an OpenID Connect (OIDC) provider, the application links an SSO login to a pre-existing local username/password account based solely on the email claim from the identity provider (IdP), without verifying an email_verified (or Microsoft xms_edov) signal and without requiring the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email address can authenticate as that victim and obtain a full session without any consent or interaction from the victim. The issue is fixed in version 2.4.0.

Technical Analysis

CVE-2026-62367 is classified as CWE-287 (Improper Authentication). The vulnerability resides in Vikunja's OIDC authentication flow when the optional emailfallback feature is enabled per-provider. The intended behavior of an email fallback in SSO deployments is to reconcile an externally authenticated identity with an existing local account. The defect is that this reconciliation trusts the email claim as proof of identity ownership.

Two trust failures combine to create the vulnerability:

1. Unverified email claim trust. The fallback path never checks an email_verified claim (nor Microsoft's xms_edov claim, which conveys email ownership verification for Microsoft Entra ID). Because the claim is not validated as verified, any IdP or any principal able to obtain a token from the configured issuer containing an arbitrary email value can assert ownership of that email.

2. Password bypass on account match. When the fallback matches an existing local (username + password) account, the flow links the SSO identity to that account and issues a full session. It never requires the matched account's password nor any additional proof of ownership of the local account. This turns a claim-only match into full account takeover.

The attack surface is the OIDC login endpoint of a Vikunja instance configured with an OIDC provider that has emailfallback enabled. Exploitation requires the attacker to hold a token issued by the configured issuer (self-registered account on the IdP, a compromised low-privilege IdP account with controllable email, or any issuer misconfiguration where email claims are attacker-influenced). This raises attack complexity relative to a purely unauthenticated flaw, but the consequence is a complete authentication bypass to the victim's account, including administrative accounts if an administrator's email matches.

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network reachability, high attack complexity due to the requirement of a token from the configured issuer carrying a victim email, low privileges required (authenticated on the IdP), no user interaction, and high confidentiality/integrity impact. Availability is not impacted. No official CVSS score was published in the source data; the vector above should be treated as an analytic estimate, not a vendor or NVD score.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-62367. The attack chain below is inferred from the vulnerability class (improper authentication / identity-claim trust) and the NVD description. The only named components are those in the description: the emailfallback per-provider option, the OIDC provider, the email claim, and the email_verified / xms_edov signals.

1. Reconnaissance / target identification. The attacker identifies a Vikunja instance (versions 1.0.0 through 2.3.0) whose OIDC login is exposed and whose configured provider has emailfallback enabled. The presence of the OIDC login flow, the issuer used, and the required email value (the victim's address) are the key facts the attacker needs. Because the attack requires a token from the configured issuer, the attacker first maps which IdP the instance trusts.

2. Triggering the flaw class. The attacker obtains a token from the configured issuer that carries a victim's email address. Depending on the IdP, this may be achieved by registering on the issuer with that email where the issuer does not enforce verification, by controlling an account whose email claim is attacker-settable, or by any issuer-side weakness that permits an unverified email claim. The enabling condition is that the issuer issues a token with the victim's email and the fallback performs no email_verified / xms_edov check.

3. Payload / execution method (vulnerability-class level). The attacker presents that token to the Vikunja OIDC login flow for the affected instance with emailfallback enabled. Vikunja matches the email claim to a pre-existing local (username + password) account and links the SSO login to it. No password for the matched local account is requested or required. No victim interaction or consent is involved.

4. Post-exploitation impact. The attacker obtains a full session as the victim, with that account's privileges and data access in Vikunja. If an administrator's email is targeted, the attacker gains administrative access to the instance, including task, project, and user data. There is no indication of remote code execution; impact is confidentiality and integrity of the application's data and configuration, consistent with the analytic vector (C:H/I:H/A:N).

Impact Assessment

For organizations running a self-hosted Vikunja instance (1.0.0 - 2.3.0) configured with an OIDC provider and emailfallback enabled, this vulnerability enables full session takeover of any local account whose email matches an attacker-obtainable IdP token claim. Blast radius is bounded by the number of local accounts whose emails can be asserted, but can include instance administrators, making the effective impact equivalent to full administrative compromise in the worst case.

Business impact includes unauthorized access to and modification of tasks, projects, attachments, and user/team data hosted in Vikunja, and potential lateral use of an administrator session to modify OIDC configuration or create persistent access. Availability is unaffected (A:N). Exploitation does not require victim interaction (UI:N), which lowers the barrier for targeted, low-observability abuse. Because the vulnerability concerns federated identity, organizations that rely on SSO for strong authentication lose that assurance for matched local accounts.

Detection Guidance

Sigma Rule

title: Potential Vikunja OIDC Email Fallback Account Takeover (CVE-2026-62367)
id: 3b6f4b9a-2c1e-4f6d-9a7e-8c0e1d2f4a55
status: experimental
description: Detects successful OIDC logins in Vikunja that are linked to a pre-existing local account via email fallback, consistent with exploitation of CVE-2026-62367.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62367
author: valtersit.com
date: 2026/01/01
logsource:
  product: vikunja
  service: authentication
detection:
  selection_event:
    event.action: 'login'
    event.outcome: 'success'
  selection_sso:
    authentication.type: 'oidc'
    authentication.source|contains: 'emailfallback'
  selection_link:
    message|contains:
      - 'emailfallback'
      - 'linked'
  condition: selection_event and (selection_sso or selection_link)
falsepositives:
  - Legitimate first-time OIDC logins for users whose email matches an existing local account.
level: medium
tags:
  - attack.t1078
  - cve.2026.62367

YARA Rule

rule CVE_2026_62367_Vikunja_EmailFallback
{
    meta:
        description = "Detects Vikunja source/build artefacts referencing the OIDC emailfallback path vulnerable to CVE-2026-62367"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-62367"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "emailfallback" ascii nocase
        $b = "email_verified" ascii nocase
        $c = "xms_edov" ascii nocase
        $d = "oidc" ascii nocase

    condition:
        ($a and $d) or ($b and $d) or ($c and $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62367 Vikunja OIDC emailfallback authentication abuse attempt"; flow:to_server,established; http.uri; content:"/api/v1"; content:"oidc"; nocase; http.header; content:"Authorization"; content:"Bearer"; distance:0; reference:cve,2026-62367; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-62367; classtype:attempted-user; sid:202662367; rev:1;)

Elastic Detection

authentication where event.action == "login" and event.outcome == "success" and
  authentication.type == "oidc" and
  (authentication.source : "emailfallback" or message : "emailfallback")

Splunk SPL Query

index=vikunja sourcetype=vikunja:auth OR sourcetype=vikunja:server
| search ("emailfallback" OR "oidc" OR "email_verified")
| eval risk="potential CVE-2026-62367 OIDC email fallback exploitation"
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users by src_ip risk
| where count > 0

Wazuh OSSEC Rule

<group name="vikunja,cve-2026-62367,">
  <rule id="202662367" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">login</field>
    <field name="event.outcome">success</field>
    <match>emailfallback</match>
    <description>CVE-2026-62367: Vikunja OIDC email fallback login linked to local account - possible account takeover</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations. Disable the per-provider emailfallback option on all configured OIDC providers in Vikunja until the instance is upgraded. Where the feature cannot be disabled immediately, restrict which issuers are trusted and ensure the configured issuer strictly enforces verified email addresses, since the vulnerable path itself performs no email_verified / xms_edov validation and requires no password for the matched local account. Limiting network exposure of the OIDC login endpoint reduces the attack surface.

2. Patch / upgrade. Upgrade Vikunja to version 2.4.0, which the advisory states fixes the issue. Confirm the upgrade against the official GitHub Security Advisory (GHSA) for this CVE, since the patch is currently claimed by a single source and not independently verified. After upgrading, re-enable emailfallback only if required and only for issuers that emit and enforce verified email claims.

3. Long-term hardening. Enforce email_verified (or Microsoft xms_edov) checks in any identity-linking logic; require an additional proof-of-ownership step (for example, a password or out-of-band confirmation) before linking an SSO identity to a pre-existing local account; monitor successful OIDC logins for anomalous account-linking events; and review local accounts that overlap in email with IdP identities to reduce the set of takeover-eligible accounts. Apply the principle of least privilege to administrative accounts and avoid reusing administrative email addresses across loosely trusted IdPs.

References

• NVD — CVE-2026-62367: https://nvd.nist.gov/vuln/detail/CVE-2026-62367
• Vikunja GitHub Security Advisory (GHSA) — fix released in version 2.4.0 (patch source cited)
• CWE-287: Improper Authentication — https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1078: Valid Accounts — https://attack.mitre.org/techniques/T1078/
• Vikunja project documentation on OpenID Connect provider configuration (per-provider emailfallback option)

No threat actor campaigns or exploit-in-the-wild evidence are identified in the provided data. CVE-2026-62367 is not listed in CISA KEV, and no public PoC or exploit code is available as of this report.