Vikunja versions 0.22.0 through 2.3.0 contain a critical authentication bypass vulnerability in API token management. The flaw stems from failure to validate the principal type when resolving identities through the generic web.Auth.GetID() interface. Since user IDs and link-share IDs are independent numeric sequences resolved through the same interface, an attacker can craft a link-share JWT whose numeric ID matches a target user's ID. An authenticated attacker can enumerate a target's user ID via user search, then create link shares until the sequence ID matches the target user's ID, effectively impersonating that user against the /api/v1/tokens endpoints. This allows the attacker to list, create, and delete the victim's API tokens, including issuing new tokens with attacker-chosen scopes under the victim's permissions. The vulnerability is fixed in Vikunja version 2.4.0.