What is GHSA-p2vv-wrh8-x466?

GHSA-p2vv-wrh8-x466 is a security advisory published by GitHub Security Advisories with High severity. Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth...

Which CVE IDs does GHSA-p2vv-wrh8-x466 cover?

GHSA-p2vv-wrh8-x466 covers the following CVE IDs: CVE-2026-91973. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p2vv-wrh8-x466?

GHSA-p2vv-wrh8-x466 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-p2vv-wrh8-x466HighCVSS 7.5

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91973 →

📋 Description

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2
https://nvd.nist.gov/vuln/detail/CVE-2026-91973
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth
https://github.com/advisories/GHSA-p2vv-wrh8-x466