{"items":[{"id":"NVI-00011886","kind":"vulnerability","title":"Vikunja: TOTP secret is readable after enrollment, no step-up auth","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-88f6-4rjv-x774","CVE-2026-91982"],"plain_summary":"GitHub lists this reviewed advisory for code.vikunja.io/api. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5136dcf25557ca63550879ad7dd7db93"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5136dcf25557ca63550879ad7dd7db93","url":"https://github.com/advisories/GHSA-88f6-4rjv-x774","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-88f6-4rjv-x774","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:22.124Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5136dcf25557ca63550879ad7dd7db93"],"technology":"code.vikunja.io/api","known_exclusions":[],"conditions_summary":"### Summary\nOnce a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into your own authenticator and keep generating valid codes indefinitely.\n\n### Details\n`GET /api/v1/user/settings/totp` returns the full TOTP object, including the secret field and the otpauth:// provisioning URL. `GET /api/v1/user/settings/totp/qrcode` renders the same secret as a QR image. Neither requires re-authentication, the access token alone is enough.\n\nThis is inconsistent with the rest of the flow: `POST /api/v1/user/settings/totp/disable` calls CheckUserPassword before it will turn TOTP off. So the destructive action is gated behind the password, but reading out the secret that backs the second factor isn't. There's also no reason for the secret to be readable at all once enrollment is finished, the client only needs it during setup.\n\nThe fix is to stop returning secret/url/the QR code once enabled is true (only expose them during the enrollment window). Requiring the password on ","public_affected_ranges":["<= 2.5.0"]}],"null_published_at":"2026-11-01T01:03:56.613Z","source_updated_at":"2026-10-09T20:51:19.000Z","source_disclosed_at":"2026-10-09T20:51:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:22.124Z"}],"next_cursor":null,"snapshot_revision":"42594"}