CVE-2026-91973: Vikunja CalDAV Authentication Bypass Flaw

CVE-2026-91973 Overview

CVE-2026-91973 is an authentication bypass vulnerability in Vikunja, an open-source task management application, affecting all versions prior to 2.6.0. The flaw resides in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against the /dav, /.well-known, and /feeds routes. These requests bypass the instance's anti-brute-force controls and enable compromise of password-only accounts. The vulnerability is tracked under [CWE-307: Improper Restriction of Excessive Authentication Attempts].

Critical Impact

Attackers can perform unlimited password-guessing attempts against Vikunja accounts without triggering lockouts, leading to full account takeover of any password-only account.

Affected Products

• Vikunja versions prior to 2.6.0
• Vikunja CalDAV BasicAuth endpoints (/dav, /.well-known, /feeds)
• Self-hosted Vikunja instances exposing CalDAV to the network

Discovery Timeline

• 2026-09-15 - CVE-2026-91973 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91973

Vulnerability Analysis

Vikunja implements anti-brute-force controls that throttle repeated failed authentication attempts against its primary login flow. The CalDAV integration exposes a parallel authentication path using HTTP Basic Authentication (BasicAuth) on /dav, /.well-known, and /feeds. This path was not wired into the same rate limiting middleware that protects the standard login endpoint.

An unauthenticated attacker can send arbitrary volumes of Authorization: Basic requests to these CalDAV routes. Each request validates the supplied credentials against the same account store used by the web UI. Because no attempt counter or delay is enforced, the attacker can enumerate password candidates at network speed until a valid credential pair is found.

Accounts protected by additional factors such as TOTP are outside the vulnerability's confidentiality impact, but any password-only account can be compromised.

Root Cause

The root cause is missing enforcement of authentication attempt limits on the CalDAV request pipeline. The BasicAuth handler served requests directly without consulting the shared brute-force protection component. This is a classic instance of [CWE-307] where a secondary authentication surface bypasses controls applied to the primary surface.

Attack Vector

Exploitation requires only network reachability to a vulnerable Vikunja instance. The attacker constructs standard HTTP requests to a CalDAV path with a Basic credential header containing a base64-encoded username:password pair. The attacker iterates through candidate passwords for a known or enumerated username. No user interaction, prior authentication, or elevated privilege is required.

A successful guess returns an authenticated CalDAV response, confirming valid credentials that can then be reused against the main Vikunja web interface and API.

For implementation-level details, refer to the GitHub Security Advisory GHSA-m469-88xx-8rx2 and the VulnCheck Advisory on Vikunja.

Detection Methods for CVE-2026-91973

Indicators of Compromise

• High volumes of HTTP requests to /dav, /.well-known, or /feeds paths carrying Authorization: Basic headers from a single source or small set of sources.
• Repeated 401 responses on CalDAV endpoints followed by an eventual 200 or 207 response for the same username.
• Successful CalDAV authentication from a source IP that has no prior interaction with the Vikunja web UI.

Detection Strategies

• Parse Vikunja and reverse-proxy access logs for request bursts against /dav, /.well-known, and /feeds correlated with Authorization: Basic headers.
• Alert on authentication failure ratios exceeding a defined threshold per source IP or per target username within a short time window.
• Correlate CalDAV authentication success events with prior failure sequences to identify credential-guessing that ultimately succeeded.

Monitoring Recommendations

• Forward Vikunja application logs and upstream web server logs to a centralized log platform for retention and query.
• Track CalDAV endpoint request rates as a baseline metric and alert on statistical anomalies.
• Review authenticated user session origins for CalDAV clients that do not match expected user devices or geolocations.

How to Mitigate CVE-2026-91973

Immediate Actions Required

• Upgrade Vikunja to version 2.6.0 or later, which applies rate limiting to CalDAV BasicAuth endpoints.
• Force a password reset for any accounts whose logs show suspicious CalDAV authentication activity prior to patching.
• Enable multi-factor authentication for all Vikunja accounts where supported to remove password-only exposure.

Patch Information

The Vikunja project addressed the issue in version 2.6.0 by extending the anti-brute-force middleware to cover /dav, /.well-known, and /feeds routes. Administrators should follow the upgrade guidance in the GitHub Security Advisory GHSA-m469-88xx-8rx2 and validate the deployed version after upgrade.

Workarounds

• Place Vikunja behind a reverse proxy such as nginx, Traefik, or Caddy and enforce rate limits on the affected CalDAV paths.
• Restrict access to /dav, /.well-known, and /feeds to trusted IP ranges or authenticated VPN users until the upgrade is applied.
• Disable CalDAV functionality at the reverse proxy layer if the feature is not required by the deployment.

# Example nginx rate limit for Vikunja CalDAV endpoints
limit_req_zone $binary_remote_addr zone=vikunja_dav:10m rate=5r/m;

server {
    location ~ ^/(dav|\.well-known|feeds) {
        limit_req zone=vikunja_dav burst=5 nodelay;
        limit_req_status 429;
        proxy_pass http://vikunja_backend;
    }
}