7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34727

CVE-2026-34727: Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34727

CVE-2026-34727:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the OIDC callback handler, which fails to enforce Two-Factor Authentication (TOTP). The analysis of the provided patches, specifically commit 0991bdec3fe78683b8a4902d06d3b9eb7386a115, reveals that the HandleCallback function in pkg/modules/auth/openid/openid.go was modified to address this issue. The patch introduces a call to a new function, enforceTOTPIfRequired, within HandleCallback. This new function checks if the user has TOTP enabled and validates the provided passcode. Before this change, HandleCallback would proceed to issue a JWT token without any TOTP verification, leading to the authentication bypass. Therefore, HandleCallback is the vulnerable function as it was the entry point for the OIDC login flow and lacked the necessary security check.

Vulnerable functions

HandleCallback

pkg/modules/auth/openid/openid.go

The `HandleCallback` function is responsible for handling the OIDC authentication callback. Prior to the patch, this function would issue a JWT token after successfully authenticating a user via OIDC, but it failed to check if the user had Two-Factor Authentication (TOTP) enabled. This allowed an attacker who could authenticate with a matching email address on the OIDC provider to bypass the TOTP step and gain full access to the user's account.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.