Kimai - CraftedSignal Threat Feed

Kimai REST API Two-Factor Authentication Bypass Vulnerability

hello@craftedsignal.io — Tue, 14 Jul 2026 00:35:22 +0000

A critical authentication bypass vulnerability, identified as CVE-2026-52827, affects Kimai versions prior to 2.59.0, allowing attackers to circumvent Two-Factor Authentication (TOTP) for the REST API. This flaw enables an attacker who has compromised a user's password to obtain a KIMAI_SESSION cookie during the initial login phase, even before the TOTP step is completed. By replaying this cookie against any /api/* endpoint, the attacker gains full authenticated API access as the legitimate user without ever needing to provide the second authentication factor. This vulnerability effectively nullifies 2FA protection for Kimai's API, exposing affected instances to unauthorized data access and manipulation.

Attack Chain

An attacker obtains a user's password for a Kimai instance through various means (e.g., phishing, credential stuffing, or password reuse).
The attacker initiates a login attempt to the Kimai web UI (/en/auth/login) using the compromised credentials.
Kimai's authentication process validates the provided password and, before prompting for the Two-Factor Authentication (TOTP) code, issues a KIMAI_SESSION cookie.
The attacker intercepts this KIMAI_SESSION cookie from the HTTP response, prior to the TOTP verification step.
The attacker then crafts subsequent HTTP requests to any /api/* endpoint, including the intercepted KIMAI_SESSION cookie in the request headers.
Due to a logical flaw in Kimai's API firewall and APIVoter (specifically using IS_AUTHENTICATED instead of IS_AUTHENTICATED_REMEMBERED and not properly checking TwoFactorTokenInterface status), the API treats the session as fully authenticated.
This grants the attacker complete, unauthorized access to the Kimai REST API, allowing them to perform any actions permitted to the compromised user, effectively bypassing the intended 2FA protection.
The attacker can now exfiltrate sensitive data, manipulate time entries, or perform other malicious actions via the API.

Impact

This vulnerability completely neutralizes the protection offered by Two-Factor Authentication for Kimai's REST API. If an attacker successfully compromises a user's password, they gain full authenticated API access, irrespective of whether 2FA is enabled for that account. This can lead to unauthorized access to sensitive user data, manipulation of time tracking entries, and other critical business functions managed via the API. The exploit requires only the compromised password and the KIMAI_SESSION cookie, making it a straightforward attack vector.

Recommendation

Patch Kimai installations immediately to version 2.59.0 or later to address CVE-2026-52827, which includes updated API firewall logic.
Verify that the config/packages/security.yaml file in your Kimai instance correctly utilizes IS_AUTHENTICATED_REMEMBERED for API paths and that the APIVoter checks for TwoFactorTokenInterface and IS_AUTHENTICATED_2FA_IN_PROGRESS status, as outlined in the solution section of the advisory.

Kimai Docker Image Default APP_SECRET Allows Account Takeover (CVE-2026-52824)

hello@craftedsignal.io — Tue, 14 Jul 2026 00:08:54 +0000

A critical vulnerability (CVE-2026-52824) affects the official Kimai Docker image, enabling unauthenticated attackers to achieve full account takeover. The root cause is the Docker image shipping with a hardcoded APP_SECRET=change_this_to_something_unique environment variable, which is a known secret. This APP_SECRET is used by the underlying Symfony framework to HMAC-sign sensitive data such as the KIMAI_REMEMBER cookie, login links, and password reset URLs. If a Kimai instance is deployed via Docker without explicitly overriding this default APP_SECRET, an attacker can leverage this known value to forge valid authentication tokens. This allows them to bypass authentication and log in as any user, including super_admin, provided the attacker knows the username, can guess the sequential user ID, and the target account does not have 2FA enabled. The vulnerability affects Kimai versions up to and including 2.57.0.

Attack Chain

Reconnaissance: An unauthenticated attacker identifies an internet-exposed Kimai instance.
Vulnerability Identification: The attacker determines that the Kimai instance is running the official Docker image with the default, known APP_SECRET.
Target Identification: The attacker identifies a target username (e.g., super_admin) and guesses the corresponding sequential user ID (often 1 for the initial admin account).
Token Forgery: Using the publicly known default APP_SECRET (change_this_to_something_unique), the attacker crafts a valid HMAC-signed KIMAI_REMEMBER cookie or a login link URL for the target user ID.
Authentication Bypass: The attacker sends the forged cookie in an HTTP request to the Kimai instance or navigates directly to the forged login link.
Account Takeover: The vulnerable Kimai instance validates the forged cookie or login link using the default APP_SECRET and grants the attacker authenticated access to the target user's account without requiring valid credentials.
Post-Exploitation: The attacker gains full control over the compromised user's account, potentially performing further actions like privilege escalation, data exfiltration, or establishing additional persistence.

Impact

Any Kimai instance deployed via its official Docker image without overriding the default APP_SECRET is critically vulnerable to unauthenticated account takeover. An attacker can compromise super_admin accounts, leading to full control over the Kimai application, its data, and potentially integrated systems. This can result in unauthorized access to sensitive project and user data, manipulation of timesheets, or disruption of business operations. The attacker only needs to know a username, guess a sequential user ID, and the account must not have active two-factor authentication. This vulnerability affects a broad range of organizations using Kimai for time tracking and project management.

Recommendation

Patch CVE-2026-52824: Immediately update all Kimai instances to a patched version (newer than 2.57.0), which includes updates to entrypoint.sh to generate a random APP_SECRET and removes the default from the Dockerfile.
Configure APP_SECRET: For all Kimai Docker deployments, explicitly set a unique and strong APP_SECRET environment variable using Docker secrets or Kubernetes secrets management. Do not rely on the default value.
Review Documentation: Refer to the updated Kimai security documentation (linked in references) for best practices regarding APP_SECRET configuration.
Enable Multi-Factor Authentication: For critical accounts, enable 2FA where available to add an additional layer of security, as the attack is mitigated if 2FA is active.