MinorCritical vulnerability

CVE-2026-123497 (CVSS 7.6)

NVD · officialPublished Nov 8, 2026Risk 23/100EPSS 0.2%

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

Technical details

CVSS

7.6

AV:NetworkAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source