CVE-2026-33473: TOTP Replay in Vikunja API

The primary impact of CVE-2026-33473 is unauthorized access to user accounts. An attacker who obtains a valid TOTP code for a Vikunja user can replay that code to authenticate as that user, gaining access to their data and potentially performing actions on their behalf. This could include accessing sensitive information, modifying data, or even deleting accounts. The risk is amplified if the user has administrative privileges within the Vikunja instance, potentially leading to broader system compromise. While the 30-second window limits the immediate impact, it provides a short opportunity for malicious activity before the TOTP expires.

1. Reserved2026-03-20
2. Published2026-03-20
3. Modified2026-03-25
4. EPSS updated2026-04-01

The primary mitigation for CVE-2026-33473 is to upgrade to Vikunja API version 2.2.1 or later, which includes a fix for the TOTP replay vulnerability. If an immediate upgrade is not possible, consider implementing temporary workarounds such as shortening the TOTP validity window (if Vikunja allows it) or increasing monitoring for suspicious login attempts. Review Vikunja's audit logs for any unusual authentication patterns. After upgrading, confirm the fix by attempting to reuse a previously valid TOTP code – it should be rejected.