CVE-2026-52824
Received Received - Intake

Kimai Time Tracking App Session Forgery via Weak Secret

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated attacker who reaches a deployment that did not override APP_SECRET, knows a username, correctly guesses the account ID associated with that username, and targets an account without active two-factor authentication can forge HMAC-protected authentication artifacts, including KIMAI_REMEMBER cookies and login links, to access the account without its password. The updated entrypoint generates and persists a random secret when no safe operator-provided value exists. This issue is fixed in version 2.58.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52824
EUVD
EUVD-2026-78402

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kimai kimai 2.58.0
kimai kimai to 2.58.0 (inc)
kimai kimai_docker_image to 2.58.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52824 is a critical vulnerability in Kimai, an open-source time tracking application. The official Docker image sets a default secret key (APP_SECRET) to a public placeholder value. This secret is used to sign authentication tokens like login links and cookies. Attackers can exploit this by knowing a username, guessing the account ID, and targeting accounts without two-factor authentication to forge these tokens and gain unauthorized access.

Detection Guidance

Check if your Kimai Docker deployment uses the default APP_SECRET value by inspecting the Dockerfile or running: docker exec <container_name> env | grep APP_SECRET. If it shows change_this_to_something_unique, the system is vulnerable.

Impact Analysis

If you use Kimai's Docker image without updating or setting a unique APP_SECRET, attackers could take over user accounts, including admin accounts, by forging authentication tokens. This could lead to unauthorized access to sensitive data, manipulation of time tracking records, or complete system compromise. Accounts with two-factor authentication are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using vulnerable Kimai instances may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update Kimai to version 2.58.0 or later. For Docker deployments, ensure APP_SECRET is set to a unique random value before starting the container. Verify the entrypoint script generates a random secret on first run.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart