CVE-2026-62367: Vikunja Auth Bypass Vulnerability

CVE-2026-62367 Overview

CVE-2026-62367 is an authentication bypass vulnerability in Vikunja, an open-source self-hosted task management platform. The flaw affects versions 1.0.0 through 2.3.0 when administrators enable the per-provider emailfallback option on an OpenID Connect (OIDC) provider. Vikunja links a Single Sign-On (SSO) login to a pre-existing local account using only the email claim from the Identity Provider (IdP). The implementation never checks the email_verified claim or Microsoft xms_edov signal and never requires the matched account's password. An attacker holding a token from the configured issuer carrying a victim's email takes over the victim's account without consent or interaction.

Critical Impact
An attacker who can obtain an OIDC token containing a victim's email address can fully authenticate as that victim, bypassing password requirements and gaining a complete session.

Affected Products

Vikunja versions 1.0.0 through 2.3.0
Deployments with OIDC provider and emailfallback option enabled
Vikunja version 2.4.0 contains the fix

Discovery Timeline

2026-10-09 - CVE-2026-62367 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-62367

Vulnerability Analysis

The vulnerability is classified under [CWE-287] Improper Authentication. Vikunja's OIDC flow supports an emailfallback mode that permits linking an SSO login to an existing local (username+password) account when email addresses match. The matching logic trusts the email claim in the IdP token without validating whether that email has been verified by the issuer.

Two compounding issues enable account takeover. First, the code path accepts any email value regardless of verification status. Second, the fallback never challenges the user for the local account's password before completing the link. The result is that possession of a valid issuer-signed token containing a target email is sufficient to assume the identity of any Vikunja user whose local account uses that email.

Root Cause

The root cause is a missing authenticity check on the email claim combined with absent credential re-validation. OIDC providers may issue tokens where the email field is user-controlled or unverified. Microsoft Entra ID, for example, exposes the xms_edov signal to indicate email verification status. Vikunja's claims struct did not define an EmailVerified field, so the fallback linking proceeded unconditionally.

Attack Vector

An attacker registers or controls an account at the configured OIDC issuer and sets the account's email to the victim's address. If the issuer does not require email verification, or if the attacker exploits a provider that emits unverified email claims, the IdP returns a token bearing the victim's email. Submitting this token to Vikunja triggers the emailfallback match and the attacker receives a full session as the victim.

// Patch excerpt: pkg/modules/auth/openid/openid.go
// Adds email_verified parsing to the OIDC claims structure.

// boolish decodes a JSON bool or the strings "true"/"false"/"1"/"0" — some
// OIDC providers emit email_verified as a string.
type boolish bool

func (b *boolish) UnmarshalJSON(data []byte) error {
	var raw any
	if err := json.Unmarshal(data, &raw); err != nil {
		return err
	}
	switch v := raw.(type) {
	case bool:
		*b = boolish(v)
	case string:
		*b = boolish(v == "true" || v == "1")
	default:
		*b = false
	}
	return nil
}

type claims struct {
	Email              string                   `json:"email"`
	EmailVerified      boolish                  `json:"email_verified"`
	Name               string                   `json:"name"`
	PreferredUsername  string                   `json:"preferred_username"`
	Nickname           string                   `json:"nickname"`
}

Source: GitHub Commit 7854f27

Detection Methods for CVE-2026-62367

Indicators of Compromise

OIDC authentication events that successfully link to local accounts without a preceding password authentication for the same user
New SSO sessions originating from unexpected IdP subject identifiers but matching existing local account emails
Session creation entries in Vikunja logs referencing emailfallback for accounts that historically used only password login

Detection Strategies

Review Vikunja authentication logs for OIDC callbacks that completed account linking against pre-existing local accounts
Correlate SSO login timestamps with user activity to identify sessions that no legitimate user initiated
Audit configured OIDC providers for the emailfallback option and flag any issuer that does not enforce email verification

Monitoring Recommendations

Alert on first-time OIDC logins that resolve to accounts previously authenticated only by local credentials
Monitor administrative configuration changes that enable emailfallback on any provider
Capture and retain IdP token claims, including email_verified and xms_edov, for forensic correlation

How to Mitigate CVE-2026-62367

Immediate Actions Required

Upgrade Vikunja to version 2.4.0 or later, which validates email_verified before linking accounts
Disable the emailfallback option on all OIDC provider configurations until the upgrade is applied
Audit existing user sessions and revoke any that cannot be attributed to legitimate activity
Reset passwords and session tokens for accounts whose emails are reachable at the configured issuer

Patch Information

The fix is included in Vikunja v2.4.0. See the GitHub Security Advisory GHSA-xv7q-fvmc-jx96 and the GitHub Release v2.4.0 for release details. The patch introduces an EmailVerified claim field and rejects fallback linking when the issuer has not verified the email.

Workarounds

Set emailfallback: false on each OIDC provider block in the Vikunja configuration file
Restrict OIDC authentication to issuers that enforce verified email addresses on all accounts
Require users to log in with their local credentials and manually link OIDC identities through an authenticated session

bash

# Example: disable emailfallback in Vikunja config
# config.yml
auth:
  openid:
    enabled: true
    providers:
      - name: corporate-idp
        authurl: https://idp.example.com
        clientid: vikunja
        clientsecret: REDACTED
        emailfallback: false