CVE-2026-52824: Kimai Time Tracker Auth Bypass Vulnerability

CVE-2026-52824 Overview

Kimai is an open-source time tracking application used across many self-hosted deployments. Versions prior to 2.58.0 ship an official Docker image that sets APP_SECRET to the publicly known default value change_this_to_something_unique in the Dockerfile. The .docker/entrypoint.sh script does not replace or reject this value before Symfony consumes it as kernel.secret. Because this secret protects HMAC-based authentication artifacts, an unauthenticated attacker who reaches a deployment that never overrode the default can forge KIMAI_REMEMBER cookies and login links. This weakness is tracked under [CWE-1188: Insecure Default Initialization of Resource].

Critical Impact
Unauthenticated attackers can forge HMAC-protected authentication artifacts and access accounts without two-factor authentication, bypassing password authentication entirely.

Affected Products

Kimai time tracking application (official Docker image)
All Kimai versions prior to 2.58.0
Deployments that did not explicitly override APP_SECRET

Discovery Timeline

2026-09-15 - CVE-2026-52824 published to NVD
2026-09-16 - Last updated in NVD database
Fixed version - Kimai 2.58.0 released with patched entrypoint

Technical Details for CVE-2026-52824

Vulnerability Analysis

Symfony applications use kernel.secret to derive HMAC signatures for authentication tokens, remember-me cookies, and signed URLs such as login links. Kimai's Docker image seeded this value with a public string that anyone can read from the upstream repository. When operators deployed the container without overriding the APP_SECRET environment variable, all HMAC computations inside the running instance used a known key. An unauthenticated attacker who identifies a target deployment, learns a valid username, correctly guesses the numeric account identifier bound to that username, and finds an account without active two-factor authentication can forge valid KIMAI_REMEMBER cookies or signed login links. The result is full account takeover without knowledge of the password.

Root Cause

The root cause is an insecure default initialization pattern. The Dockerfile pins APP_SECRET=change_this_to_something_unique, and the original entrypoint.sh performs no validation to reject the placeholder value or generate a random replacement. Symfony then trusts this key as authoritative cryptographic material.

Attack Vector

Exploitation is network-reachable and requires no privileges or user interaction, but does require an attacker to know a username and correctly guess the associated account ID. Accounts protected by active two-factor authentication are not affected because the forged artifact alone does not satisfy the second factor.

bash

   echo "Kimai is ready"
 }
 
+function ensureAppSecret() {
+  # GHSA-jr9p-4h4j-6c58
+  # Make sure the container never runs with the publicly-known default APP_SECRET.
+  # If the user provided their own value (via -e APP_SECRET=...) it is kept untouched.
+  # Otherwise a unique secret is generated once and persisted below var/data, which
+  # is the directory mounted as a named volume in the documented Docker setup, so it
+  # stays stable across container restarts and re-creations.
+  { set +x; } 2>/dev/null
+
+  local SECRET_FILE=/opt/kimai/var/data/.appsecret
+  local ENV_LOCAL=/opt/kimai/.env.local
+
+  rm -f "$ENV_LOCAL"
+
+  if [ -n "$APP_SECRET" ] && [ "$APP_SECRET" != "change_this_to_something_unique" ]; then
+    set -x
+    return
+  fi

Source: GitHub Commit 31a8f88. The patch rejects the known-default value and generates a persistent random secret when no operator-provided value is present.

Detection Methods for CVE-2026-52824

Indicators of Compromise

Presence of APP_SECRET=change_this_to_something_unique in running container environment or .env files
Successful authentication events without matching password submission or interactive login flows
Unexpected KIMAI_REMEMBER cookies presented from previously unseen source IP addresses
Login link URLs consumed for accounts that never requested a password reset or magic link

Detection Strategies

Inspect deployed Kimai containers for the default APP_SECRET value by querying container environment variables
Correlate authentication logs against reverse-proxy access logs to identify sessions established without a corresponding POST /login request
Alert on remember-me cookie authentications for accounts that lack two-factor authentication and have never used the remember-me feature

Monitoring Recommendations

Enable and centralize Kimai application logs and web server access logs
Track account-takeover indicators such as sudden email address, password, or 2FA configuration changes on accounts that recently authenticated via remember-me
Monitor container build pipelines to detect images that ship with placeholder secrets in environment variables

How to Mitigate CVE-2026-52824

Immediate Actions Required

Upgrade all Kimai Docker deployments to version 2.58.0 or later
Rotate APP_SECRET to a unique high-entropy value on every deployment and invalidate all existing remember-me tokens and signed URLs
Enable two-factor authentication for all user accounts, especially administrative accounts
Review authentication logs for signs of forged token use since the container was first deployed

Patch Information

The fix is included in Kimai 2.58.0. The updated .docker/entrypoint.sh script generates and persists a random secret to /opt/kimai/var/data/.appsecret when no safe operator-provided value exists, and explicitly rejects the change_this_to_something_unique placeholder. See the GitHub Security Advisory GHSA-jr9p-4h4j-6c58, the Kimai Security Advisory, and the GitHub Release v2.58.0.

Workarounds

Set APP_SECRET to a unique random value via -e APP_SECRET=... or Docker Compose environment configuration before restarting the container
Restrict network exposure of Kimai instances to trusted networks or behind an authenticated reverse proxy until the upgrade is applied
Enforce two-factor authentication for every account to break the forged-artifact single-factor bypass path