CVE-2026-33315: Vikunja Authentication Bypass Vulnerability

CVE-2026-33315 Overview

CVE-2026-33315 is an authentication bypass vulnerability in Vikunja, an open-source self-hosted task management platform. The vulnerability exists in versions prior to 2.2.0 where the CalDAV endpoint allows login using Basic Authentication, enabling attackers to bypass Time-based One-Time Password (TOTP) verification on accounts with two-factor authentication (2FA) enabled. This flaw allows unauthorized access to project information that should be protected behind 2FA, including project names, descriptions, and other sensitive task management data.

Critical Impact

Attackers can bypass 2FA protections on Vikunja accounts by exploiting the CalDAV endpoint's Basic Authentication mechanism, gaining unauthorized access to protected project data.

Affected Products

• Vikunja versions prior to 2.2.0
• Self-hosted Vikunja instances with CalDAV integration enabled
• Vikunja deployments relying on 2FA/TOTP for account security

Discovery Timeline

• 2026-03-24 - CVE-2026-33315 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33315

Vulnerability Analysis

This vulnerability represents an Authentication Bypass flaw classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The core issue lies in how Vikunja's CalDAV endpoint handles authentication requests. While the main application interface properly enforces 2FA/TOTP verification when configured, the CalDAV API endpoint accepts Basic Authentication credentials without requiring the secondary TOTP factor.

This creates a parallel authentication path that bypasses the security controls implemented in the primary authentication flow. An attacker with knowledge of valid user credentials can leverage this alternate authentication channel to access protected resources without completing the full multi-factor authentication process.

The vulnerability allows access to standard project information including project names, descriptions, and potentially task data that users intended to protect with 2FA enforcement.

Root Cause

The root cause of CVE-2026-33315 stems from inconsistent authentication enforcement across different API endpoints. The CalDAV integration, which provides calendar and task synchronization capabilities with external applications, was implemented with Basic Authentication support to maintain compatibility with standard CalDAV clients. However, the authentication logic for this endpoint failed to verify whether the authenticating user's account had 2FA enabled and whether the TOTP challenge had been satisfied.

This architectural oversight created a security bypass where the CalDAV endpoint operated independently of the 2FA enforcement logic applied to other parts of the application.

Attack Vector

The attack is network-based and requires no user interaction. An attacker who has obtained valid user credentials through phishing, credential stuffing, or other means can directly authenticate to the CalDAV endpoint using HTTP Basic Authentication. The attack sequence involves:

1. The attacker identifies a Vikunja instance with CalDAV enabled
2. Using compromised credentials, the attacker crafts a request to the CalDAV endpoint with Basic Authentication headers
3. The CalDAV endpoint validates the username and password but fails to check for 2FA requirements
4. The attacker gains access to the user's project data, bypassing the TOTP protection the user had enabled

The CalDAV endpoint typically accessible at paths like /dav/ accepts standard HTTP Basic Authentication headers, making exploitation straightforward for attackers with valid credentials.

Detection Methods for CVE-2026-33315

Indicators of Compromise

• Unusual CalDAV endpoint access from unexpected IP addresses or geographic locations
• Authentication logs showing successful CalDAV logins for 2FA-enabled accounts without corresponding TOTP verification events
• Increased CalDAV API requests from accounts that don't typically use calendar synchronization
• Access patterns showing data retrieval via CalDAV for users who normally access the web interface

Detection Strategies

• Monitor authentication logs for CalDAV endpoint access and correlate with 2FA verification logs
• Implement alerting for successful CalDAV authentications from 2FA-enabled accounts
• Review access logs for the /dav/ endpoint path for anomalous patterns
• Deploy web application firewalls with rules to detect and alert on Basic Authentication bypass attempts

Monitoring Recommendations

• Enable detailed logging for all CalDAV endpoint authentication attempts
• Configure security information and event management (SIEM) rules to detect 2FA bypass scenarios
• Implement user and entity behavior analytics (UEBA) to identify unusual CalDAV access patterns
• Regularly audit accounts with 2FA enabled for any unexpected CalDAV-based access

How to Mitigate CVE-2026-33315

Immediate Actions Required

• Upgrade Vikunja to version 2.2.0 or later immediately
• Review audit logs for any suspicious CalDAV endpoint access on 2FA-enabled accounts
• Consider temporarily disabling CalDAV access until the patch is applied
• Notify users with 2FA-enabled accounts to review their access history for unauthorized activity

Patch Information

The vulnerability has been patched in Vikunja version 2.2.0. The fix ensures that 2FA verification is properly enforced across all authentication channels, including the CalDAV endpoint. The patch commit (cdf5d30a425d032f749b78b98b828f25ad882615) modifies the authentication flow to require TOTP verification before granting access via CalDAV Basic Authentication for accounts with 2FA enabled.

For detailed patch information, refer to the GitHub Security Advisory GHSA-47cr-f226-r4pq and the Vikunja v2.2.0 Release Changelog.

Workarounds

• Disable CalDAV functionality entirely if not required until the patch can be applied
• Implement network-level restrictions to limit CalDAV endpoint access to trusted IP ranges
• Use a reverse proxy to block or restrict access to the /dav/ endpoint paths
• Require VPN access for CalDAV synchronization to add an additional authentication layer

# Example nginx configuration to restrict CalDAV access
# Add to your Vikunja server block as a temporary mitigation

location /dav/ {
    # Restrict CalDAV access to trusted internal networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Alternatively, disable CalDAV entirely until patched
    # return 403 "CalDAV temporarily disabled for security";
    
    proxy_pass http://vikunja-backend;
}