5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35597

CVE-2026-35597: Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then unconditionally rolls back. HandleFailedTOTPAuth in pkg/user/totp.go uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone. The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time. This allows unlimited brute-force attempts against TOTP codes. This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35597

CVE-2026-35597:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by improper database transaction management in the TOTP authentication flow. When a user provides an invalid TOTP code, the apiv1.Login function correctly identifies the failure and calls user.HandleFailedTOTPAuth to log the attempt and lock the account after 10 failures. However, the Login function then proceeds to roll back the database session. The HandleFailedTOTPAuth function, in its vulnerable form, used this same session to update the user's status to 'locked'. Consequently, the database update was always reverted, and the account was never actually locked. An attacker with knowledge of a user's password could therefore perform unlimited attempts to guess the TOTP code. The patch addresses this by making HandleFailedTOTPAuth create and manage its own database session, committing the account lock in a separate transaction that is not affected by the rollback in the parent Login function.

Vulnerable functions

apiv1.Login

pkg/routes/api/v1/login.go

This function handles the login process. When TOTP validation fails, it calls `HandleFailedTOTPAuth` but then unconditionally rolls back the database transaction (`s.Rollback()`). This rollback undoes the account lock action performed by `HandleFailedTOTPAuth`, rendering the account lockout mechanism ineffective against brute-force attacks.

user.HandleFailedTOTPAuth

pkg/user/totp.go

This function is responsible for tracking failed TOTP attempts and locking the account. In the vulnerable version, it operated on the database session passed from the `Login` function. Because the `Login` function always rolled back this session after a TOTP failure, the call to `user.SetStatus(s, StatusAccountLocked)` was never persisted to the database, thus failing to lock the account.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.