Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.
PUBLISHED5.2CWE-312CWE-916
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Problem type
- CWE-312: Cleartext Storage of Sensitive Information
- CWE-916: Use of Password Hash With Insufficient Computational Effort
Affected products
go-vikunja
vikunja
< 2.4.0 - AFFECTED
References
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv
https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323
https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323
https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d
https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d
https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85
https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85
https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
GitHub Security Advisories
GHSA-r6w9-259g-gwrv
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
https://github.com/advisories/GHSA-r6w9-259g-gwrvSummary
Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the user_tokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords.
Details
pkg/user/token.go — genToken() stores the raw random string directly:
func genToken(u *User, kind TokenKind) (*Token, error) {
tokenStr, err := utils.CryptoRandomString(tokenSize)
...
return &Token{
UserID: u.ID,
Kind: kind,
Token: tokenStr, // stored as-is, no hashing
}, nil
}
Lookup also uses plaintext equality:
func getToken(s *xorm.Session, token string, kind TokenKind) (t *Token, err error) {
has, err := s.Where("kind = ? AND token = ?", kind, token).Get(t)
}
Affected token types:
TokenPasswordReset(pkg/user/user_password_reset.go:120)TokenEmailConfirm(pkg/user/user_create.go:101,pkg/user/update_email.go:88)TokenAccountDeletion(pkg/user/delete.go:102)
Note: CalDAV tokens correctly use generateHashedToken with bcrypt — the same protection is absent for the above types.
PoC
-- Attacker with DB read dumps all pending password-reset tokens:
SELECT u.email, t.token FROM user_tokens t
JOIN users u ON u.id = t.user_id WHERE t.kind = 1;
-- Then takes over any account:
curl -X POST https://vikunja.example.com/api/v1/user/password/reset \
-H 'Content-Type: application/json' \
-d '{"token": "<plaintext_from_db>", "new_password": "AttackerPass1!"}'
Impact
Any read access to the database (leaked backup, cloud misconfiguration, secondary SQLi) allows an attacker to take over every user account with a pending reset token within the 24-hour token lifetime. Full account takeover including admin accounts.
Fix
Replace genToken with generateHashedToken for TokenPasswordReset, TokenEmailConfirm, and TokenAccountDeletion. Update the corresponding lookup to use bcrypt comparison (bcrypt.CompareHashAndPassword) rather than direct SQL equality, mirroring the existing CalDAV token implementation in the same file.
If possible, please apply for a CVE number when posting.
github.com
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv
github.com
https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323
github.com
https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d
github.com
https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85
github.com
https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
github.com
https://github.com/advisories/GHSA-r6w9-259g-gwrv
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-62376Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-62376",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-10-09T20:50:35.524Z",
"dateReserved": "2026-07-13T22:04:59.678Z",
"datePublished": "2026-10-09T20:50:35.524Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-10-09T20:50:35.524Z"
},
"title": "Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access",
"descriptions": [
{
"lang": "en",
"value": "Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue."
}
],
"affected": [
{
"vendor": "go-vikunja",
"product": "vikunja",
"versions": [
{
"version": "< 2.4.0",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-312: Cleartext Storage of Sensitive Information",
"cweId": "CWE-312",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-916: Use of Password Hash With Insufficient Computational Effort",
"cweId": "CWE-916",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv",
"name": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r6w9-259g-gwrv",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323",
"name": "https://github.com/go-vikunja/vikunja/commit/00fd2c6155c01faae99be4226b931d8091fd6323",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d",
"name": "https://github.com/go-vikunja/vikunja/commit/3a0ea15d8c18ff960bc98ae39950fa7a14b0af7d",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85",
"name": "https://github.com/go-vikunja/vikunja/commit/e31ea2de5040fa63bc97cf4df63bafed3bd9ad85",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0",
"name": "https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
]
}
}
}