Kimai vulnerabilities
We track 8 vulnerabilities in Kimai products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.
Latest Kimai vulnerabilities
- 7.1 High severity
kimai: Improper Authentication
Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICA
- 9.1 Critical severity
kimai: Initialization of a Resource with an Insecure Default
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony us
- 8.8 High severity
kimai: Incorrect Authorization
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/de
- 7.5 High severity
kimai: Protection Mechanism Failure
Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate ser
- 7.5 High severity
kimai: Weak Password Recovery Mechanism for Forgotten Password
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset
- 8.8 High severity
kimai: Missing Authorization
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members
- 8.8 High severity
Kimai: Sensitive Cookie with Improper SameSite Attribute
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a
- 7.2 High severity
kimai: Improper Neutralization of Special Elements Used in a Template Engine
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a special