Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
Summary
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
Original description
The description as published by the source.
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web vikunja.io