CVE-2026-91972

Executive Summary

CVE-2026-91972 is a missing rate-limiting vulnerability (CWE-307) in the Vikunja task-management platform affecting all versions before 2.6.0. The /api/v2 public authentication endpoints — login, register, password-reset, and OAuth token routes — do not enforce request throttling, allowing remote unauthenticated attackers to conduct unbounded credential guessing, account enumeration, and password-reset flooding. With a CVSS v3.1 base score of 7.5 (High) and no public PoC or KEV listing, the issue is a high-likelihood, moderate-sophistication vector given the low attack complexity (AC:L) and lack of required privileges (PR:N).

Technical Analysis

The vulnerability class is a missing/inadequate rate-limiting control (CWE-307: Improper Restriction of Excessive Authentication Attempts). Vikunja's public authentication surface under /api/v2 — including the login, registration, password-reset, and OAuth token issuance routes — accepts an unbounded number of requests from a single source. Because no per-IP, per-account, or global throttle is applied, each endpoint can be invoked at wire speed.

Three distinct failure modes follow from the same root cause:

1. Credential guessing (brute force / password spraying): The login endpoint returns authentication verdicts without consuming a rate-limit budget, so an attacker may attempt an arbitrary number of username/password pairs. Default AC:L and PR:N scores reflect that any internet-reachable instance is trivially reachable.
2. Account enumeration: Without throttling, the login and password-reset endpoints can be probed to distinguish valid from invalid accounts based on differential responses or timing. Attackers iterate a candidate username list to build a target roster.
3. Password-reset flooding: The password-reset route can be invoked repeatedly for a victim address, generating mail floods, exhausting SMTP quotas, and enabling resource exhaustion or denial-of-service against mail infrastructure.

No specific function names, class names, file paths, or parameter identifiers are provided in the NVD description, so the analysis remains at the vulnerability-class level. The confidentiality impact is rated High (C:H) because successful guessing or enumeration yields credential/account intelligence; integrity and availability impacts are rated None in the CVSS vector, though password-reset flooding may produce availability pressure on mail systems in practice that the base vector does not capture.

The affected surface is the HTTP API (/api/v2), reachable over the network (AV:N). The flaw is structural: authentication endpoints were deployed without a throttling layer, and the fix in 2.6.0 is reported to introduce rate limiting on these routes.

Exploitation Scenarios

Per NVD, no public proof-of-concept exists; the attack chain below is inferred at the vulnerability-class level from the missing rate-limit condition and the named endpoints.

1. Reconnaissance / target identification. The attacker identifies an internet-exposed Vikunja instance serving /api/v2. Fingerprinting may rely on the application's HTTP responses and API base path. No exploitation prerequisite beyond network reachability exists.
2. Trigger of the flaw class. The attacker sends repeated, automated requests to the /api/v2 public authentication endpoints — login, register, password-reset, and OAuth token routes. The absence of throttling means the server does not reject, delay, or lock out after high-volume request bursts.
3. Payload / execution method. At the class level: credential-guessing campaigns submit large dictionaries of username/password pairs to the login route; account enumeration submits candidate usernames to login/register/password-reset and observes success-versus-failure behavior; password-reset flooding submits repeated reset requests for a victim identifier. OAuth token routes may similarly be cycled to attempt token or authorization-code guessing.
4. Post-exploitation impact. Recovered valid credentials grant authenticated access to the Vikunja workspace (task/project data, user content), consistent with the C:H rating. Enumerated accounts feed further targeted attacks (spear-phishing, credential stuffing against reused passwords). Reset flooding degrades mail service and can be used as a nuisance or resource-exhaustion vector.

Note: No public exploit code, Nuclei template, or KEV entry is associated with this CVE at time of writing.

Impact Assessment

• CVSS v3.1: 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vector indicates a remotely reachable, low-complexity, unauthenticated attack that yields high confidentiality impact with no demonstrated integrity or availability impact in the base score.
• Affected systems: All Vikunja deployments before 2.6.0 exposing /api/v2 authentication endpoints to untrusted networks, especially internet-facing instances.
• Business impact: Compromise of user credentials and workspace data; downstream credential-stuffing risk where users reuse passwords; mail infrastructure abuse via password-reset flooding; potential account-takeover of users with weak passwords.
• Blast radius: Every reachable unauthenticated client is a potential attacker. The absence of throttling turns the entire user base into a brute-force target surface. The EPSS score is not yet available from FIRST.org, so exploit-likelihood weighting cannot be quantitatively applied; no KEV listing means no confirmed in-the-wild exploitation is currently tracked.

Detection Guidance

Sigma Rule

title: Vikunja API v2 Authentication Endpoint Brute Force Attempt
id: 7f3a9c21-4b8e-4d6f-9a2c-1e5b7d9f0c34
status: experimental
description: Detects high-volume requests to Vikunja /api/v2 public authentication endpoints (login, register, password-reset, OAuth token), consistent with missing rate-limit abuse (CVE-2026-91972).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91972
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: vikunja
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/v2/login'
      - '/api/v2/register'
      - '/api/v2/password'
      - '/api/v2/oauth'
      - '/api/v2/token'
  selection_method:
    cs-method: 'POST'
  timeframe: 5m
  condition: selection_endpoint and selection_method | count() > 50 by src_ip
falsepositives:
  - Legitimate login retries by users
  - Automated integration testing
level: high
tags:
  - attack.t1110
  - attack.credential_access

YARA Rule

rule CVE_2026_91972_Vikunja_AuthProbe
{
    meta:
        description = "Detects automated tooling strings targeting Vikunja /api/v2 authentication endpoints (CVE-2026-91972)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91972"
        date = "2026-01-01"
    strings:
        $api = "/api/v2/login" ascii nocase
        $reg = "/api/v2/register" ascii nocase
        $pwd = "/api/v2/password" ascii nocase
        $oauth = "/api/v2/oauth" ascii nocase
        $tool1 = "hydra" ascii nocase
        $tool2 = "medusa" ascii nocase
        $tool3 = "ffuf" ascii nocase
        $tool4 = "gobuster" ascii nocase
    condition:
        (any of ($api, $reg, $pwd, $oauth)) and (any of ($tool*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91972 Vikunja API v2 Auth Brute Force Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v2/"; http.uri; content:"login"; threshold:type both, track by_src, count 50, seconds 300; classtype:attempted-user; reference:cve,2026-91972; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91972; sid:2026919720; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and
    wildcard(http.request.uri.path, "/api/v2/*login*")] with runs=50

Alternate EQL (single-event threshold query):

http where http.request.method == "POST" and
  (http.request.uri.path : "/api/v2/login" or
   http.request.uri.path : "/api/v2/register" or
   http.request.uri.path : "/api/v2/password" or
   http.request.uri.path : "/api/v2/oauth")

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "/api/v2/%")
| search uri_path IN ("*login*", "*register*", "*password*", "*oauth*", "*token*")
| bin _time span=5m
| stats count AS attempts dc(uri_path) AS distinct_eps by src_ip _time
| where attempts > 50
| table _time, src_ip, attempts, distinct_eps

Wazuh OSSEC Rule

<group name="vikunja,cve-2026-91972,web,">
  <rule id="202691" level="10" frequency="50" timeframe="300">
    <if_matched_sid>31151</if_matched_sid>
    <match>/api/v2/</match>
    <match>POST</match>
    <description>CVE-2026-91972: Excessive authentication requests to Vikunja /api/v2 endpoints from same source (rate-limit bypass / brute force)</description>
    <mitre>
      <id>T1110</id>
    </mitre>
    <group>authentication_failures,brute_force,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch via OSV; not independently confirmed).

1. Immediate mitigations (no confirmation of vendor fix required):
   • Front the Vikunja /api/v2 endpoints with a reverse proxy or WAF and apply rate limiting to the login, register, password-reset, and OAuth token routes (e.g., request-per-minute caps per source IP and per account).
   • Apply IP-based throttling, temporary lockout, and CAPTCHA challenges on repeated failures to the login and password-reset routes.
   • Restrict management of the instance to trusted networks; avoid exposing authentication endpoints directly to the internet where not required.
   • Alert on high-volume bursts to /api/v2 authentication paths (see Detection Guidance).
2. Patch / upgrade steps:
   • Upgrade to Vikunja 2.6.0 or later, which is reported to add rate limiting to the affected /api/v2 public authentication endpoints.
   • Validate the upgrade against a staging clone before production; confirm throttling behavior post-upgrade with controlled test bursts.
   • Monitor vendor channels to independently confirm the fix, given the single-source patch claim.
3. Long-term hardening:
   • Enforce strong password policy and encourage MFA where supported to reduce brute-force payoff.
   • Integrate authentication telemetry into the SIEM with baseline thresholds and automated response for anomalous bursts.
   • Conduct periodic review of all authentication-adjacent endpoints (including OAuth token issuance) for rate-limiting coverage as part of secure SDLC.

References

• NVD — CVE-2026-91972: https://nvd.nist.gov/vuln/detail/CVE-2026-91972
• CWE-307: Improper Restriction of Excessive Authentication Attempts — https://cwe.mitre.org/data/definitions/307.html
• MITRE ATT&CK T1110 — Brute Force: https://attack.mitre.org/techniques/T1110/
• OSV database (patch claim source): https://osv.dev/
• CISA KEV Catalog (CVE-2026-91972 NOT listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign note: No known threat actor association, exploit-in-the-wild evidence, or public PoC exists for CVE-2026-91972 at time of writing. EPSS has not yet scored this CVE. Reports should be reviewed if new exploitation signals emerge.