CVE-2026-52824 Details

A critical vulnerability has been identified in Kimai, an open-source time tracking application, specifically in versions through 2.57.0. The issue arises from the official Docker image, which sets the APP_SECRET environment variable to a default, publicly known value. This default value is not replaced or validated before being used by Symfony, leaving the application vulnerable to exploitation. An unauthenticated attacker who knows a username and can guess the associated account ID, targeting an account without active two-factor authentication, can forge HMAC-protected authentication tokens, including KIMAI_REMEMBER cookies and login links, to gain unauthorized access to the account. The vulnerability has been addressed in Kimai version 2.58.0, which updates the Docker entrypoint to generate a random secret when no user-provided value is available, and ensures that the new secret is stored in a way that persists across container restarts.

Users of Kimai who are still using the default APP_SECRET value should update to version 2.58.0 or later. Existing installations should set a unique and random APP_SECRET value before updating.