---
id: CVE-2026-91982
title: >-
  Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after
  enrollment through the GET /api/v1/user/settings/totp and
  /api/v1/user/settings/totp/qrcode endpoints without re-authentication
summary: >-
  Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after
  enrollment through the GET /api/v1/user/settings/totp and
  /api/v1/user/settings/totp/qrcode endpoints without re-authentication.
  Attackers with a valid access toke…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-522
vendor: go-vikunja
product: vikunja
affected:
  - vikunja < 2.6.0
published: '2026-09-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T16:18:32.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91982'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T15:13:37.907700Z'
epss: 0.00276
epssPercentile: 0.2027
ingestedAt: '2026-09-15T15:39:12.911Z'
---

## Overview

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.