CyberRota Analysis
AI-GeneratedVikunja versions prior to 2.6.0 expose the raw TOTP shared secret through specific API endpoints without requiring re-authentication, allowing attackers with valid access tokens to access this sensitive information. This vulnerability enables them to import the TOTP secret into their own authenticator apps, potentially leading to account takeover by bypassing two-factor authentication. Organizations using Vikunja should prioritize upgrading to version 2.6.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.