Vikunja présente une réutilisation de TOTP pendant la fenêtre de validité

The primary impact of CVE-2026-33473 is unauthorized access to user accounts. An attacker who obtains a valid TOTP code for a Vikunja user can replay that code to authenticate as that user, gaining access to their data and potentially performing actions on their behalf. This could include accessing sensitive information, modifying data, or even deleting accounts. The risk is amplified if the user has administrative privileges within the Vikunja instance, potentially leading to broader system compromise. While the 30-second window limits the immediate impact, it provides a short opportunity for malicious activity before the TOTP expires.

Users of Vikunja API who have enabled 2FA and are running versions prior to 2.2.1 are at risk. This includes individuals and organizations relying on Vikunja for task management and collaboration, particularly those with sensitive data stored within the system. Shared hosting environments running Vikunja are also at increased risk due to potential cross-tenant vulnerabilities.

• linux / server:

journalctl -u vikunja -g "totp validation"

• generic web:

curl -s -o /dev/null -w '%{http_code}' <vikunja_url>/api/login | grep 200

• database (redis):

INFO totp_validation_attempts

1. 2026-03-20Disclosure

   disclosure

1. Réservé2026-03-20
2. Publiée2026-03-20
3. Modifiée2026-03-25
4. EPSS mis à jour2026-04-01

The primary mitigation for CVE-2026-33473 is to upgrade to Vikunja API version 2.2.1 or later, which includes a fix for the TOTP replay vulnerability. If an immediate upgrade is not possible, consider implementing temporary workarounds such as shortening the TOTP validity window (if Vikunja allows it) or increasing monitoring for suspicious login attempts. Review Vikunja's audit logs for any unusual authentication patterns. After upgrading, confirm the fix by attempting to reuse a previously valid TOTP code – it should be rejected.