GHSA-jmr8-r558-3jhx

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

Published

2026-09-15

Modified

2026-10-09

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-88f6-4rjv-x774. This link is maintained to preserve external references. ### Original Description Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-jmr8-r558-3jhx