CVE-2026-111917: Vikunja Session Validation Auth Bypass

CVE-2026-111917 Overview

CVE-2026-111917 is an improper session validation vulnerability in Vikunja, an open-source task management platform. Versions 2.3.0 through 2.6.x fail to validate the JWT sid claim against the active sessions table inside the handleAuth function. Attackers holding a stolen access token can maintain WebSocket connections to /api/v2/ws even after the user deletes the session or enrolls in TOTP. The persistent channel continues to deliver notification.created pushes containing comment, task, and project content belonging to the victim. The flaw is tracked under CWE-613: Insufficient Session Expiration.

Critical Impact

Revoked sessions remain active on the WebSocket channel, allowing attackers with stolen tokens to continue receiving confidential task, comment, and project notifications.

Affected Products

• Vikunja 2.3.0 through 2.6.x
• Vikunja WebSocket endpoint /api/v2/ws
• Fixed in Vikunja 2.7.0

Discovery Timeline

• 2026-10-17 - CVE-2026-111917 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111917

Vulnerability Analysis

Vikunja issues JWT access tokens that include a session identifier (sid) claim bound to a row in the backend sessions table. REST handlers correctly check whether the referenced session has been revoked. The WebSocket authentication path, implemented in handleAuth, verifies the JWT signature and expiration but omits the lookup against the sessions table. As a result, logout, session deletion, and TOTP enrollment do not disconnect existing WebSocket clients and do not reject reconnects presenting the same token.

An attacker who obtains a valid access token through phishing, token theft, or client-side disclosure retains the ability to subscribe to the victim's notification.created event stream. The stream carries the rendered content of new comments, tasks, and project updates, producing an ongoing information disclosure channel that bypasses standard session hygiene.

Root Cause

The root cause is a missing authorization check in the WebSocket authentication handler. handleAuth treats a cryptographically valid, non-expired JWT as sufficient proof of an active session. It does not cross-reference the sid claim against the authoritative sessions table, breaking the contract that session revocation terminates all access channels.

Attack Vector

Exploitation requires low privileges and a previously issued access token for a target account. The attacker opens or maintains a WebSocket to /api/v2/ws using the stolen token. Even after the legitimate user logs out, deletes the session from the account management UI, or enrolls in TOTP to force reauthentication, the attacker's connection remains authorized. Any new notification pushed to the victim is replayed to the attacker in real time.

No verified exploit code is published. See the GitHub Security Advisory GHSA-4hv6-xc92-j86g and the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-111917

Indicators of Compromise

• Long-lived WebSocket connections to /api/v2/ws that persist beyond user logout events in application logs.
• WebSocket sessions whose JWT sid claim does not appear in the current sessions table.
• Reconnects to /api/v2/ws using tokens tied to sessions that were explicitly deleted or invalidated by TOTP enrollment.

Detection Strategies

• Correlate authentication events, session deletion events, and active WebSocket connections to flag mismatches between revoked sessions and open channels.
• Instrument the reverse proxy or Vikunja logs to record the sid claim for every WebSocket upgrade and audit it against the sessions table.
• Monitor for unusual geographic or user-agent diversity on WebSocket connections for a single user account.

Monitoring Recommendations

• Alert when the same JWT is used from multiple IP addresses on /api/v2/ws within a short window.
• Review WebSocket connection duration metrics for sessions outliving the configured JWT lifetime.
• Ingest Vikunja application and proxy logs into a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2026-111917

Immediate Actions Required

• Upgrade Vikunja to version 2.7.0 or later across all instances.
• Rotate JWT signing secrets after upgrade to invalidate every outstanding access token.
• Force all users to reauthenticate and re-enroll active MFA factors.
• Audit WebSocket connection logs for sessions that outlived their corresponding session records.

Patch Information

The Vikunja maintainers resolved the issue in version 2.7.0. The fix adds a session table lookup inside handleAuth so that the WebSocket authentication path rejects tokens whose sid claim is no longer present. Deployment details are published in GHSA-4hv6-xc92-j86g.

Workarounds

• Place Vikunja behind a reverse proxy that terminates idle WebSocket connections and enforces short connection lifetimes.
• Shorten the JWT access token lifetime in Vikunja configuration to reduce the window in which a stolen token remains valid.
• Restrict access to /api/v2/ws by source network where feasible until the patch is applied.

# Example: terminate long-lived WebSocket connections at an nginx reverse proxy
# until Vikunja 2.7.0 can be deployed
location /api/v2/ws {
    proxy_pass http://vikunja_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
}