CVE-2026-80196: Kimai Authentication Bypass Vulnerability

CVE-2026-80196 Overview

CVE-2026-80196 is an authentication bypass vulnerability in Kimai time-tracking software before version 2.58.0. The flaw exists in the password reset workflow, where the LoginLink signature covers only the user ID and omits the password hash. As a result, password reset links remain valid even after the target user has changed their password. An attacker who intercepts or caches a reset link can reuse it up to two additional times within a one-hour window to authenticate as the victim. The issue is tracked under CWE-640: Weak Password Recovery Mechanism.

Critical Impact
Attackers who obtain a single password reset link can log in as the targeted Kimai user even after that user changes their password, defeating credential rotation as a containment control.

Affected Products

Kimai versions prior to 2.58.0
Self-hosted Kimai deployments using the built-in password reset workflow
Kimai instances relying on Symfony LoginLink for reset token generation

Discovery Timeline

2026-08-26 - CVE-2026-80196 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80196

Vulnerability Analysis

Kimai generates password reset links using Symfony's LoginLink component. The cryptographic signature attached to each link is computed over the user identifier only. It does not incorporate the current password hash or a per-request nonce that is invalidated on password change.

Because the signature ignores password state, a reset link remains cryptographically valid across password changes. The link expires only when its time-to-live elapses or when its usage counter is exhausted. Kimai permits up to three uses of the link within a one-hour window.

An attacker who obtains a reset link through email interception, browser cache, proxy logs, or referrer leakage retains authenticated access to the victim's account. Password rotation by the legitimate user does not revoke the attacker's foothold. The impact is confined to confidentiality of the user session; the CVSS vector reports no direct integrity or availability impact.

Root Cause

The root cause is an insufficient signature scope in the reset token construction. Secure reset flows bind tokens to volatile state such as the current password hash or a stored single-use identifier. Kimai's implementation binds only to the user ID, so the token survives credential changes.

Attack Vector

Exploitation requires the attacker to obtain a valid reset link. Common exposure paths include compromised mail relays, shared inbox access, HTTP referrer headers, browser history on shared endpoints, and log aggregation systems that capture full URLs. Once obtained, the attacker replays the link over the network without any user interaction from the victim.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-m492-gv72-xvxj and the VulnCheck Advisory on Kimai Authentication Bypass.

Detection Methods for CVE-2026-80196

Indicators of Compromise

Multiple successful authentications for the same user from distinct IP addresses or user agents within a one-hour window following a password reset request.
Access to Kimai /login_check or /reset-password routes with a signed LoginLink query parameter after the target user has already rotated credentials.
Reset link URLs appearing in outbound proxy logs, SIEM ingestion pipelines, or mail archive systems.

Detection Strategies

Correlate security.authentication.success events in Kimai logs with recent password_change events for the same user account.
Alert when a LoginLink token is consumed more than once, or when it is consumed after a subsequent password change for the same identity.
Hunt for reset-link URL patterns in web server access logs and identify reuse from non-owner source addresses.

Monitoring Recommendations

Forward Kimai application logs and reverse-proxy access logs to a centralized analytics platform to enable cross-event correlation.
Monitor for anomalous session establishment immediately after password reset requests, especially from geolocations that differ from the user's baseline.
Track email gateway alerts for reset messages routed through unexpected relays or forwarded to external addresses.

How to Mitigate CVE-2026-80196

Immediate Actions Required

Upgrade Kimai to version 2.58.0 or later, which extends the LoginLink signature to invalidate reset links after password changes.
Invalidate all outstanding password reset tokens and force session termination for active users after upgrading.
Audit authentication logs for the past reset-link TTL window and identify any suspicious logins that followed a password change.

Patch Information

The fix is delivered in Kimai 2.58.0. According to the GitHub Security Advisory GHSA-m492-gv72-xvxj, the maintainers modified the login link signature to cover credential state so that reset links are invalidated when the user's password changes. Administrators of self-hosted deployments should apply the upstream release and restart the application.

Workarounds

Reduce the LoginLink lifetime and maximum usage counter in configuration to shrink the exploitation window until the patch is deployed.
Disable the password reset feature and require administrator-driven credential resets for high-value accounts.
Enforce multi-factor authentication so that a replayed reset link alone is insufficient to complete login.

bash

# Configuration example: shorten LoginLink lifetime and single-use enforcement
# config/packages/security.yaml
security:
    firewalls:
        main:
            login_link:
                check_route: login_link_check
                lifetime: 300      # seconds (default 600)
                max_uses: 1        # single-use token