{"schema":"threatline.record/2","record":{"id":"CVE-2026-91973","aliases":["GHSA-m469-88xx-8rx2","GO-2026-6737"],"summary":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","details":"### Summary\nThe `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.\n\n### Details\n`pkg/routes/routes.go` (~lines 238-249) registers `/.well-known`, `/dav`, and `/feeds` with `middleware.BasicAuth(...)` and nothing else; `registerCalDavRoutes` adds no limiter. `pkg/routes/caldav/auth.go` (~lines 88-93) falls through to `user.CheckUserCredentials` with the plain account password when no CalDAV token matches. In contrast, `/register`, `/login`, etc. are wrapped by `unauthRateLimit()` — an unconditional 10/min/IP pre-auth floor that ignores `ratelimit.enabled` (default false).\n\nTOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.\n\n### PoC (verified at runtime against v2.5.0)\n```\nPOST /api/v1/login  x25 wrong passwords  -> 429 from attempt 2 (throttled)\nPROPFIND /dav/principals/{user}/  x60 wrong passwords  -> 401 x60, 429 x0\nGET /feeds/notifications.atom  x30 wrong passwords  -> 401 x30, 429 x0\nPROPFIND /dav/... with correct password -> 207 (proves the 401s are real auth failures)\n```\n\n### Impact\nThe anti-brute-force floor guarding `/login` is entirely absent on `/dav`, `/feeds`, and `/.well-known`, giving an unbounded credential-guessing surface against account passwords. (bcrypt caps throughput to a few guesses/second, but nothing caps the number of attempts.) Reported as an authentication-control bypass, not a DoS.\n\n### Fix\nApply the unconditional pre-auth rate-limit floor to the `/dav`, `/.well-known`, and `/feeds` groups.","categories":["Libraries & packages"],"product":"code.vikunja.io/api","vendor":"go-vikunja","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m469-88xx-8rx2","source_modified_at":"2026-10-09T20:52:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"range":"<= 2.5.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91973","source_modified_at":"2026-09-15T15:55:04.161Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"vikunja","vendor":"go-vikunja","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"2.6.0"},{"version":"2.6.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m469-88xx-8rx2","source_modified_at":"2026-10-19T21:40:52.604317649Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m469-88xx-8rx2","source_modified_at":"2026-10-09T20:52:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"code.vikunja.io/api"},"version":"2.6.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91973","source_modified_at":"2026-09-15T15:55:04.161Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"vikunja","ecosystem":null},"version":"2.6.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m469-88xx-8rx2","source_modified_at":"2026-10-19T21:40:52.604317649Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"code.vikunja.io/api","purl":"pkg:golang/code.vikunja.io/api"},"version":"2.6.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00672,"percentile":0.51521,"score_date":"2026-10-23"},"published_at":"2026-09-15T15:18:23.488Z","modified_at":"2026-10-19T21:40:52.604317649Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-m469-88xx-8rx2","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-09T20:52:06Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91973","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-15T15:55:04.161Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m469-88xx-8rx2","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T21:40:52.604317649Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91973","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91973","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/pull/3688","source":"GitHub Advisory Database"},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth","tags":["third-party-advisory"]},{"url":"https://github.com/advisories/GHSA-m469-88xx-8rx2","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-15T15:53:33.159049Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T21:40:52.604317649Z","content_hash":"a823a85fa56949a188c8911b14d4981e7726ed31a6ff2c2b2f37c87eb67e865b"}}