CVE-2026-29794: Vikunja Auth Bypass Vulnerability

CVE-2026-29794 Overview

CVE-2026-29794 is a rate limit bypass vulnerability in Vikunja, an open-source self-hosted task management platform. The vulnerability allows unauthenticated users to circumvent the application's built-in rate-limiting mechanism by spoofing the X-Forwarded-For or X-Real-IP HTTP headers. This flaw exists because the rate-limiting implementation relies on the value returned by (echo.Context).RealIP, which can be manipulated by untrusted client input.

Attackers exploiting this vulnerability can launch brute-force attacks against authentication endpoints, enabling username enumeration and password guessing without triggering protective rate limits. The bypass effectively grants unlimited requests against any unauthenticated endpoint exposed by the application.

Critical Impact

Unauthenticated attackers can bypass rate limits to perform unlimited brute-force attacks against login endpoints, potentially compromising user accounts through credential stuffing or password guessing.

Affected Products

• Vikunja versions 0.8 through 2.1.x
• Vikunja self-hosted installations using default rate-limiting configuration
• All deployment environments where X-Forwarded-For or X-Real-IP headers are not properly sanitized by upstream proxies

Discovery Timeline

• 2026-03-20 - CVE-2026-29794 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-29794

Vulnerability Analysis

This vulnerability stems from a reliance on untrusted external data for security decisions, classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The Vikunja application implements rate limiting to protect against automated attacks, but the implementation trusts the IP address extracted from client-controllable HTTP headers.

The Echo framework's RealIP function attempts to determine the client's actual IP address by examining proxy-related headers like X-Forwarded-For and X-Real-IP. While this approach works correctly behind properly configured reverse proxies that sanitize these headers, direct client connections or misconfigured proxy setups allow attackers to inject arbitrary values.

By rotating spoofed IP addresses in these headers, an attacker appears to originate from different network locations with each request, effectively resetting the rate limit counter and enabling unlimited attempts.

Root Cause

The root cause is the application's implicit trust in the X-Forwarded-For and X-Real-IP headers without validation that these headers originate from a trusted proxy. The rate-limiting middleware uses (echo.Context).RealIP to identify clients, which prioritizes these spoofable headers over the actual TCP connection source address.

In environments where Vikunja is deployed without a properly configured reverse proxy that strips or overwrites these headers, clients can set arbitrary IP addresses that the application will use for rate-limit tracking.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying unauthenticated endpoints protected by rate limiting (e.g., login, password reset)
2. Sending requests with manipulated X-Forwarded-For or X-Real-IP headers containing different IP addresses
3. Rotating through spoofed IP addresses to avoid triggering rate limits
4. Executing brute-force attacks against user accounts without restriction

The exploitation methodology involves crafting HTTP requests with rotating IP values in the forwarded headers. Each request with a new spoofed IP address appears as a fresh client to the rate limiter, bypassing the intended protection. Attackers can automate this process using simple scripts that cycle through IP address ranges or generate random addresses for each authentication attempt.

Detection Methods for CVE-2026-29794

Indicators of Compromise

• High volume of authentication failures from requests with frequently changing X-Forwarded-For values
• Requests containing obviously spoofed IP addresses in forwarding headers (e.g., private ranges, localhost)
• Discrepancy between X-Forwarded-For header values and actual source IP addresses
• Unusual patterns in X-Real-IP headers that don't match expected proxy configurations

Detection Strategies

• Monitor web server access logs for authentication endpoints receiving requests with rotating X-Forwarded-For values
• Implement log correlation to detect mismatches between forwarding headers and actual connection source IPs
• Alert on high-frequency login attempts that appear to originate from many different IP addresses in short timeframes
• Deploy application-layer detection rules for requests containing multiple IP addresses in X-Forwarded-For chains

Monitoring Recommendations

• Configure centralized logging for all authentication-related requests with full header capture
• Establish baselines for normal authentication failure rates and alert on statistical anomalies
• Monitor for successful logins following large numbers of failed attempts from varied forwarding headers
• Review reverse proxy configurations to ensure proper handling of client IP headers

How to Mitigate CVE-2026-29794

Immediate Actions Required

• Upgrade Vikunja to version 2.2.0 or later immediately
• Review and harden reverse proxy configuration to sanitize or overwrite X-Forwarded-For and X-Real-IP headers
• Implement additional authentication protections such as account lockout or CAPTCHA challenges
• Audit authentication logs for signs of prior exploitation

Patch Information

The vulnerability has been patched in Vikunja version 2.2.0. Users should upgrade to this version or later to resolve the issue. The patch addresses the rate-limit bypass by implementing proper IP address validation and not trusting client-supplied forwarding headers in untrusted environments.

Detailed patch information is available in the GitHub Security Advisory and the Vikunja Release Changelog.

Workarounds

• Configure reverse proxy (nginx, Apache, Traefik) to strip or overwrite X-Forwarded-For and X-Real-IP headers from client requests
• Implement network-level rate limiting using WAF or load balancer rules based on actual source IP
• Deploy additional brute-force protection at the infrastructure layer independent of application rate limits
• Consider implementing multi-factor authentication to reduce the impact of credential brute-forcing

# Example nginx configuration to sanitize forwarding headers
# Add to your nginx server block or location directive

# Clear potentially spoofed headers from clients
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;

# For environments behind multiple proxies, use only trusted values
# set_real_ip_from 10.0.0.0/8;
# real_ip_header X-Forwarded-For;
# real_ip_recursive on;