ghsa:GHSA-JMR8-R558-3JHX: code.vikunja.io/api <= 2.5.0

Affected technology

code.vikunja.io/api · <= 2.5.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover. Source advisory’s CVSS 3.1 assessment rates confidentiality impact as low; integrity and availability impact as none.