CVE-2026-123497

veans could send login credentials over an unencrypted connection

Vikunja · Vikunja veans coding-agent CLI

First documented disclosure · Review checkpoint

Summary

Server discovery could silently switch to plain HTTP and retain that choice for later sessions.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The client accepted an unencrypted fallback after a secure connection failed during setup or login.

Conditions required

Someone able to interfere with the network path can disrupt the secure connection while a user initializes the client or logs in.

Potential impact

Credentials or bot tokens and subsequent task traffic could be exposed to a network observer.

Affected versions and configurations

Versions before 2.7.1 in the CNA record.

Fix and mitigation status

2.7.1, as listed by the project and CNA.

Practical next steps

Install the fix listed for 2.7.1, check the saved server address and rotate credentials used over a downgraded connection.

Operating lesson

Require explicit consent before sending credentials over an unencrypted remote connection.

Evidence and limits

At disclosure veans had no separately tagged release. Both the maintainer’s advisory and the CNA identify 2.7.1 as patched.

Sources