CVE-2026-62376 - Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
CVE ID :CVE-2026-62376 Published : Oct. 9, 2026, 8:50 p.m. | 39 minutes ago Description :Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an...