CVE-2026-111917: Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-17 · updated 2026-10-19
Weakness: CWE-613

Description

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.

Affected products

Go Code.Vikunja.Io/Api: from 2.3.0 before 2.7.0 — fixed in 2.7.0
go-vikunja vikunja: from 2.3.0 before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Go Code.Vikunja.Io/Api 2.7.0; go-vikunja vikunja 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-111917 or the next vulnerability affects your stack