CVE-2026-33473

5.7

MEDIUMCVSS v3

Published

March 24, 2026

Affected

2 projects

Assigned by

GitHub

Severity scale

010

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.

vikunja/vikunja

Docker HubOfficial docker image for Vikunja

>= 0.13, < 2.2.1NVD

go-vikunja/vikunja

GitHubThe task manager you actually own.

>= 0.13, < 2.2.1NVD

More on this CVE

NVD↗GitHub Advisory↗

Security Advisories

CVE-2026-33473

Description

More on this CVE