{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/composer/kimai/kimai--2.57.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kimai (Docker image)","composer/kimai/kimai (\u003c= 2.57.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","web-application","misconfiguration","account-takeover","docker"],"_cs_type":"advisory","_cs_vendors":["Kimai"],"content_html":"\u003cp\u003eA critical vulnerability (CVE-2026-52824) affects the official Kimai Docker image, enabling unauthenticated attackers to achieve full account takeover. The root cause is the Docker image shipping with a hardcoded \u003ccode\u003eAPP_SECRET=change_this_to_something_unique\u003c/code\u003e environment variable, which is a known secret. This \u003ccode\u003eAPP_SECRET\u003c/code\u003e is used by the underlying Symfony framework to HMAC-sign sensitive data such as the \u003ccode\u003eKIMAI_REMEMBER\u003c/code\u003e cookie, login links, and password reset URLs. If a Kimai instance is deployed via Docker without explicitly overriding this default \u003ccode\u003eAPP_SECRET\u003c/code\u003e, an attacker can leverage this known value to forge valid authentication tokens. This allows them to bypass authentication and log in as any user, including \u003ccode\u003esuper_admin\u003c/code\u003e, provided the attacker knows the username, can guess the sequential user ID, and the target account does not have 2FA enabled. The vulnerability affects Kimai versions up to and including 2.57.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance\u003c/strong\u003e: An unauthenticated attacker identifies an internet-exposed Kimai instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Identification\u003c/strong\u003e: The attacker determines that the Kimai instance is running the official Docker image with the default, known \u003ccode\u003eAPP_SECRET\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTarget Identification\u003c/strong\u003e: The attacker identifies a target username (e.g., \u003ccode\u003esuper_admin\u003c/code\u003e) and guesses the corresponding sequential user ID (often 1 for the initial admin account).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eToken Forgery\u003c/strong\u003e: Using the publicly known default \u003ccode\u003eAPP_SECRET\u003c/code\u003e (\u003ccode\u003echange_this_to_something_unique\u003c/code\u003e), the attacker crafts a valid HMAC-signed \u003ccode\u003eKIMAI_REMEMBER\u003c/code\u003e cookie or a login link URL for the target user ID.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication Bypass\u003c/strong\u003e: The attacker sends the forged cookie in an HTTP request to the Kimai instance or navigates directly to the forged login link.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccount Takeover\u003c/strong\u003e: The vulnerable Kimai instance validates the forged cookie or login link using the default \u003ccode\u003eAPP_SECRET\u003c/code\u003e and grants the attacker authenticated access to the target user's account without requiring valid credentials.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePost-Exploitation\u003c/strong\u003e: The attacker gains full control over the compromised user's account, potentially performing further actions like privilege escalation, data exfiltration, or establishing additional persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAny Kimai instance deployed via its official Docker image without overriding the default \u003ccode\u003eAPP_SECRET\u003c/code\u003e is critically vulnerable to unauthenticated account takeover. An attacker can compromise \u003ccode\u003esuper_admin\u003c/code\u003e accounts, leading to full control over the Kimai application, its data, and potentially integrated systems. This can result in unauthorized access to sensitive project and user data, manipulation of timesheets, or disruption of business operations. The attacker only needs to know a username, guess a sequential user ID, and the account must not have active two-factor authentication. This vulnerability affects a broad range of organizations using Kimai for time tracking and project management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-52824\u003c/strong\u003e: Immediately update all Kimai instances to a patched version (newer than 2.57.0), which includes updates to \u003ccode\u003eentrypoint.sh\u003c/code\u003e to generate a random \u003ccode\u003eAPP_SECRET\u003c/code\u003e and removes the default from the Dockerfile.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eConfigure APP_SECRET\u003c/strong\u003e: For all Kimai Docker deployments, explicitly set a unique and strong \u003ccode\u003eAPP_SECRET\u003c/code\u003e environment variable using Docker secrets or Kubernetes secrets management. Do not rely on the default value.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Documentation\u003c/strong\u003e: Refer to the updated Kimai security documentation (linked in references) for best practices regarding \u003ccode\u003eAPP_SECRET\u003c/code\u003e configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable Multi-Factor Authentication\u003c/strong\u003e: For critical accounts, enable 2FA where available to add an additional layer of security, as the attack is mitigated if 2FA is active.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-14T00:08:54Z","date_published":"2026-07-14T00:08:54Z","id":"https://feed.craftedsignal.io/briefs/2026-07-kimai-docker-app-secret/","summary":"A critical vulnerability, CVE-2026-52824, in the official Kimai Docker image allows unauthenticated attackers to forge authentication tokens and achieve account takeover, including super_admin accounts, due to the image shipping with a default, publicly known APP_SECRET environment variable used by Symfony to HMAC-sign session cookies and login links.","title":"Kimai Docker Image Default APP_SECRET Allows Account Takeover (CVE-2026-52824)","url":"https://feed.craftedsignal.io/briefs/2026-07-kimai-docker-app-secret/"}],"language":"en","title":"CraftedSignal Threat Feed - Composer/Kimai/Kimai (\u003c= 2.57.0)","version":"https://jsonfeed.org/version/1.1"}