Update Vikunja to 2.4.0 now to prevent attackers from hijacking accounts via leaked database tokens
Open-source task manager Vikunja patched a high-severity flaw where database leaks allowed attackers to hijack accounts using exposed password-reset tokens.
Key points
- Vikunja versions prior to 2.4.0 stored critical user tokens in plaintext, rated high severity with CVSS 8.1.
- Attackers with database read access could steal password-reset, email-confirmation, and account-deletion tokens directly.
- Version 2.4.0 patches the issue by hashing tokens, preventing immediate account takeover from leaked backups or SQL exposure.
Security teams managing self-hosted task management platforms must upgrade Vikunja immediately. The vendor released version 2.4.0 in late October 2026 to address a high-severity vulnerability, CVE-2026-62376. This flaw allowed attackers to take over user accounts, including administrator privileges, if they gained read access to the underlying database. The issue stems from how the application handled sensitive authentication tokens.
How did the plaintext token flaw work?
The vulnerability existed because Vikunja stored password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` database table without hashing them. According to the GitHub advisory GHSA-r6w9-259g-gwrv, the `genToken()` function in the Go codebase saved raw random strings directly. This meant that any entity with database read privileges could view these active tokens. The advisory notes that CalDAV tokens were correctly hashed using bcrypt, but the critical account management tokens were left exposed.
What was the attack scenario for CVE-2026-62376?
An attacker needed only read access to the database to exploit this flaw. They could dump the `user_tokens` table via leaked backups, misconfigured cloud storage, or SQL-level exposure. Once the plaintext tokens were obtained, the attacker could use them within their 24-hour lifetime to reset passwords or confirm emails. The proof of concept showed that an attacker could simply query the database for pending tokens and then use an API call to force a password change, fully hijacking the account without knowing the original credentials.
Why is this rated high severity?
The NVD assigned a CVSS score of 8.1, classifying the issue as high severity. The rating reflects the potential for full account takeover, including administrative accounts, without requiring brute force or credential guessing. The weaknesses are categorised as CWE-312 (cleartext storage of sensitive information) and CWE-916 (use of password hash with improper stretching). The impact is immediate and total for any user with a pending token, making database integrity the primary control point for mitigation before patching.
What versions are affected and fixed?
All versions of Vikunja prior to 2.4.0 are affected by this vulnerability. The fix is contained exclusively in version 2.4.0. According to the vendor advisory, upgrading to this version replaces the insecure `genToken` function with `generateHashedToken` for password-reset, email-confirmation, and account-deletion operations. This ensures that even if the database is compromised, the tokens cannot be used directly by an attacker, as they are now hashed and cannot be reversed for authentication purposes.
What to do and how to stay safe: Vikunja
- Verify your current Vikunja version and upgrade to 2.4.0 or later immediately to apply the token hashing fix.
- Audit your database backup procedures and storage permissions to ensure no plaintext database files are accessible to unauthorised users.
- Review access logs for any unusual database queries or bulk data exports that may indicate prior exploitation of the plaintext tokens.
- Force password resets for all users who had active reset tokens during the period the vulnerability was present, assuming the database may have been compromised.
Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-62376 affect CalDAV tokens?
No, the advisory states that CalDAV tokens correctly use hashed storage and are not affected by this specific plaintext exposure flaw.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-62376 with a CVSS score of 8.1, which is considered high severity.
Can an attacker exploit this without database access?
No, the attacker must have read access to the database through leaks, misconfigurations, or SQL injection to obtain the plaintext tokens.
