CVE-2026-35597 | go-vikunja up to 2.2.x Login login.go HandleFailedTOTPAuth excessive authentication (GHSA-fgfv-pv97-6cmj)

A vulnerability was found in go-vikunja vikunja up to 2.2.x. It has been rated as problematic. This affects the function HandleFailedTOTPAuth of the file pkg/routes/api/v1/login.go of the component Login. Performing a manipulation results in improper restriction of excessive authentication attempts.

This vulnerability was named CVE-2026-35597. The attack may be initiated remotely. There is no available exploit.

Upgrading the affected component is advised.