CVE-2026-34727 is a high severity authentication flaw in Vikunja, a self hosted task manager. NVD scores it 7.4. The OIDC callback issued a full session token without asking for the TOTP second factor when a local user was matched by email. Upgrade to Vikunja 2.3.0 or later.
What's affected
Vikunja before 2.3.0. The fixed release is 2.3.0.
The advisory ties the issue to setups that use OIDC with the email fallback, which can map an OIDC identity to an existing local account. Local users who enabled TOTP are the ones whose second factor gets skipped.
How to check if you're exposed
Check your Vikunja version in the footer or the about page, or in the image tag if you run it in a container.
Then read your configuration for OIDC providers and see whether the email fallback is on. If you do not use OIDC, the described path does not apply, but upgrading is still sensible.
What to do now
- Upgrade Vikunja to 2.3.0 or later.
- If you cannot upgrade yet, turn off the OIDC email fallback or the OIDC provider, so local TOTP stays the only path for those accounts.
- Review sign in logs for OIDC logins on accounts that have TOTP enabled.
- Ask users with sensitive data to check their active sessions.
Why it matters
The weakness is CWE-287, improper authentication. Two login paths exist. The local one checks TOTP when it is enabled. The OIDC path did not, so it gave a way around the second factor.
The attack complexity is rated high because the attacker needs the OIDC email fallback to match a victim account, and an identity at the provider that carries the victim's email. Even so, a second factor that can be bypassed does not protect anyone.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is my OIDC provider at fault?
No. The advisory points at Vikunja's callback handler, which issued a token without checking for TOTP.
Sources
Last reviewed: 19 October 2026.
