Summary
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
The /dav, /.well-known, and /feeds groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over /dav is unbounded and never returns 429, while /api/v1/login is throttled from the tenth attempt. The only anti-brute-force control on the instance is therefore bypassable.
Details
pkg/routes/routes.go (~lines 238-249) registers /.well-known, /dav, and /feeds with middleware.BasicAuth(...) and nothing else; registerCalDavRoutes adds no limiter. pkg/routes/caldav/auth.go (~lines 88-93) falls through to user.CheckUserCredentials with the plain account password when no CalDAV token matches. In contrast, /register, /login, etc. are wrapped by unauthRateLimit(), an unconditional 10/min/IP pre-auth floor that ignores ratelimit.enabled (default false).
TOTP-enabled accounts and bot users are correctly refused, so this targets password-only accounts.
PoC (verified at runtime against v2.5.0)
POST /api/v1/login x25 wrong passwords -> 429 from attempt 2 (throttled)
PROPFIND /dav/principals/{user}/ x60 wrong passwords -> 401 x60, 429 x0
GET /feeds/notifications.atom x30 wrong passwords -> 401 x30, 429 x0
PROPFIND /dav/... with correct password -> 207 (proves the 401s are real auth failures)
Impact
The anti-brute-force floor guarding /login is entirely absent on /dav, /feeds, and /.well-known, giving an unbounded credential-guessing surface against account passwords. (bcrypt caps throughput to a few guesses/second, but nothing caps the number of attempts.) Reported as an authentication-control bypass, not a DoS.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Apply the unconditional pre-auth rate-limit floor to the /dav, /.well-known, and /feeds groups.
Frequently Asked Questions
- What is CVE-2026-91973? CVE-2026-91973 is a medium-severity security vulnerability in code.vikunja.io/api (go), affecting versions <= 2.5.0. It is fixed in 2.6.0.
- Which versions of code.vikunja.io/api are affected by CVE-2026-91973? code.vikunja.io/api (go) versions <= 2.5.0 is affected.
- Is there a fix for CVE-2026-91973? Yes. CVE-2026-91973 is fixed in 2.6.0. Upgrade to this version or later.
- Is CVE-2026-91973 exploitable, and should I be worried? Whether CVE-2026-91973 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-91973 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-91973? Upgrade
code.vikunja.io/apito 2.6.0 or later.