A critical authentication bypass vulnerability in Vikunja allows attackers to circumvent two-factor authentication for local users, potentially leading to unauthorized account access.

The OIDC callback handler fails to verify if a matched user has TOTP authentication enabled when using the email fallback mechanism. This allows an unauthenticated attacker to bypass the second factor if the target user has enrolled in TOTP.

The compromise of user accounts, particularly those with administrative privileges, poses a significant risk to organizational data integrity and confidentiality. By bypassing two-factor authentication, an attacker can gain full access to sensitive task management data. While the CVSS score of 7.4 reflects the requirement for specific conditions, the potential for total account takeover makes this a high-priority security concern.

Immediate Action: Upgrade the Vikunja API to version 2.3.0 or later to ensure proper enforcement of two-factor authentication requirements.

Proactive Monitoring: Review application access logs for unusual OIDC callback patterns or repeated login attempts originating from unexpected IP addresses.

Compensating Controls: If immediate patching is not feasible, consider temporarily disabling OIDC email fallback or restricting OIDC authentication to trusted identity providers until the update can be applied.

Public Exploit Available: Unknown

Given the ability to bypass security controls, administrators must prioritize upgrading to version 2.3.0 immediately. Failure to address this vulnerability leaves user accounts vulnerable to unauthorized access, potentially exposing all data contained within the Vikunja platform.