CVE-2026-52824

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.58.0

Description The official Docker image includes a default environment variable APP SECRET set to a publicly known value. Because the Docker entrypoint does not validate or override this value, instances deployed without a custom APP SECRET use a known Symfony kernel.secret. This allows an unauthenticated attacker to forge HMAC-signed cookies, login links, password reset URLs, and CSRF tokens. By guessing a user ID and knowing a username, an attacker can take over any account, including the super admin, provided the account does not have two-factor authentication enabled.

Recommendations Update to version 2.58.0. As a temporary mitigation, explicitly set a unique and random value for the APP SECRET environment variable in the Docker configuration.