9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27575

CVE-2026-27575: Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27575

CVE-2026-27575:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 0.24.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability identified is a combination of a weak password policy (CWE-521) and insufficient session expiration after a password change (CWE-613). The analysis of the provided commit, 89c17d3b23e2a23320ad135b4e8f0a14fdd91bda, reveals changes that address the weak password policy.

The commit modifies two main functions, UserResetPassword and UserChangePassword, which are the API endpoints for resetting and updating a user's password, respectively. The patch introduces password validation in both of these flows. Specifically:

In pkg/routes/api/v1/user_password_reset.go, a call to c.Validate(pwReset) is added within the UserResetPassword function.
In pkg/routes/api/v1/user_update_password.go, the UserPassword struct is updated with validation rules (valid:"bcrypt_password" minLength:"8" maxLength:"72") for the NewPassword field, and a corresponding c.Validate(newPW) call is added to the UserChangePassword function.

These changes confirm that prior to the patch, these two functions were vulnerable as they did not enforce minimum password strength, allowing an attacker (or user) to set a weak password. These functions would therefore appear in a runtime profile when the password change functionality is invoked.

The second part of the vulnerability, persistent sessions after a password change, is not addressed in the provided commit. The functions UserResetPassword and UserChangePassword would be the correct place to implement session invalidation logic. The absence of such changes in the patch suggests this aspect of the vulnerability might be fixed in a different commit or was not fixed at the same time. Nevertheless, the identified functions are central to the exploitation of the reported vulnerability.

Vulnerable functions

UserResetPassword

pkg/routes/api/v1/user_password_reset.go

This function handles user password resets. The patch adds a validation step for the new password. Before this change, the function did not validate the strength of the new password, allowing weak passwords to be set. This corresponds to the 'Weak Password Policy' aspect of the vulnerability (CWE-521).

UserChangePassword

pkg/routes/api/v1/user_update_password.go

This function handles password changes for authenticated users. The patch adds validation tags to the `NewPassword` field and a validation check in the function body. Before this, the function did not enforce any password strength requirements, allowing users to change their password to a weak one. This addresses the 'Weak Password Policy' (CWE-521) part of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.