{"uuid": "1435275d-05a9-4dba-b85a-ef0caaa7361a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62367", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117412965867797058", "content": "CVE-2026-62367 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-62367https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96https://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0#go-vikunja #vikunja#CVE_2026_62367#bot", "creation_timestamp": "2026-10-09T21:01:20.122990Z"}