CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123499
MEDIUMCVSS 5.9NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog