CVE-2026-52827
Received Received - Intake

Session Fixation in Kimai Time Tracking App

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICATED and App\API\Authentication\ApiRequestMatcher routes an existing session through the main firewall. A Scheb TwoFactorToken satisfies that access rule, and App\Voter\ApiVoter grants API access to its User, allowing an attacker with a valid account password to use authenticated REST API operations without entering the second factor even though web routes remain blocked. This issue is fixed in version 2.59.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52827
EUVD
EUVD-2026-78408

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kimai kimai to 2.59.0 (exc)
kimai kimai to 2.58.0 (exc)
kimai kimai 2.59.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52827 is a vulnerability in the Kimai time-tracking application that allows bypassing two-factor authentication (TOTP) for the REST API. The issue occurs because the API accepts a session cookie issued after only password verification, before the second factor (TOTP) step. This allows attackers with a valid account password to use authenticated REST API operations without entering the second factor, even though web routes remain blocked.

Detection Guidance

Check if your Kimai instance is running a vulnerable version (prior to 2.59.0) by running: grep -r "version" /path/to/kimai/composer.json. If the version is below 2.59.0, the system is vulnerable.

Impact Analysis

An attacker with a user's password can gain full API access without completing 2FA, potentially accessing sensitive data. The vulnerability allows unauthorized API operations, exposing confidential information. The impact is high confidentiality risk due to unauthorized data access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Unauthorized API access may result in data breaches, triggering legal and regulatory penalties.

Mitigation Strategies

Update Kimai to version 2.59.0 or later immediately. This can be done via Composer: composer require kimai/kimai:^2.59.0. Verify the update with: composer show kimai/kimai.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart