CVE-2026-80196

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.58.0

Description An authentication bypass exists because password reset links remain valid after a password has been changed. This occurs because the LoginLink signature only includes the user id and does not incorporate the password hash. An attacker who intercepts or caches a password reset link can use it up to two additional times within a one-hour window to gain unauthorized access to the user account.

Recommendations Update to version 2.58.0.