CVE-2026-80199
Received Received - Intake

Kimai Timing Oracle Username Enumeration Vulnerability

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kimai kimai to 2.54.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kimai before 2.54.0 has a timing oracle vulnerability in TokenAuthenticator. Unauthenticated attackers can send an X-AUTH-USER header to check if a username exists by measuring response time differences. The system skips password hashing for invalid usernames, causing faster responses. This allows username enumeration without login throttling protection.

Detection Guidance

To detect this timing oracle vulnerability, monitor response times for requests using the X-AUTH-USER header. Measure the time taken for responses when probing usernames. Valid usernames will show slightly longer response times (around 25ms) compared to invalid ones. Use tools like curl or custom scripts to send requests and analyze timing differences.

Impact Analysis

Attackers could identify valid usernames in the system, which may lead to targeted phishing or brute-force attacks. The impact is limited by the small timing gap and deprecated authentication method, but it poses a privacy risk for user enumeration.

Mitigation Strategies

Upgrade Kimai to version 2.54.0 or later to patch the vulnerability. If immediate upgrade is not possible, disable the X-AUTH-USER and X-AUTH-TOKEN headers in your web server configuration. Implement login throttling to prevent timing attacks. Monitor network traffic for suspicious timing-based username enumeration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart