CVE-2026-80199: Kimai Username Enumeration Vulnerability

CVE-2026-80199 Overview

CVE-2026-80199 is a timing oracle vulnerability in Kimai time-tracking software before version 2.54.0. The flaw resides in the TokenAuthenticator component, which processes the X-AUTH-USER header for API authentication. Unauthenticated attackers can measure response time differences to enumerate valid usernames on the application. The password hasher runs only for accounts that exist, producing a measurable timing delta between valid and invalid usernames. Kimai also lacks login throttling on this authentication path, which enables automated enumeration at scale. This vulnerability is classified under CWE-208 (Observable Timing Discrepancy).

Critical Impact
Unauthenticated attackers can enumerate valid Kimai user accounts remotely by observing timing side channels in the authentication flow, enabling targeted credential attacks.

Affected Products

Kimai time-tracking application versions prior to 2.54.0
Deployments exposing the API endpoint that consumes the X-AUTH-USER header
Self-hosted Kimai instances without upstream rate limiting or WAF-based throttling

Discovery Timeline

2026-08-26 - CVE-2026-80199 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80199

Vulnerability Analysis

Kimai's TokenAuthenticator validates API requests using the X-AUTH-USER header supplied by the client. When the header names an existing user, the authenticator invokes the configured password hashing routine to verify the associated credential. When the header names a nonexistent user, the code path exits before the hasher runs. The password hashing operation is intentionally expensive, so the two code paths complete in measurably different amounts of time. An attacker who submits requests with candidate usernames and records response latency can distinguish valid accounts from invalid ones with statistical confidence.

The absence of login throttling on this endpoint compounds the issue. Attackers can iterate through large username dictionaries without triggering account lockouts or rate limits. Enumerated usernames feed downstream attacks such as password spraying, credential stuffing, and targeted phishing against known Kimai users.

Root Cause

The root cause is an observable timing discrepancy between authentication branches. The TokenAuthenticator performs work proportional to whether the account exists, rather than executing a constant-time comparison or invoking the hasher for both branches with a dummy hash. This design leaks account existence through response latency.

Attack Vector

The attack is remote and unauthenticated. An attacker sends HTTP requests to the Kimai API with attacker-chosen values in the X-AUTH-USER header. Response time is measured for each candidate username. Repeated measurements reduce noise from network jitter, allowing reliable classification of usernames as valid or invalid. No user interaction is required.

The vulnerability mechanism is described in the Vulncheck advisory on the Kimai timing oracle and the GitHub Security Advisory for Kimai.

Detection Methods for CVE-2026-80199

Indicators of Compromise

High-volume HTTP requests to Kimai API endpoints carrying varying values in the X-AUTH-USER header from a single source or small set of sources.
Sequential or dictionary-ordered username patterns observed in access logs against authentication routes.
Elevated authentication failure counts without corresponding successful logins.

Detection Strategies

Parse Kimai web server access logs for requests that include the X-AUTH-USER header and cluster by source IP, user agent, and request cadence.
Baseline typical authentication traffic volume and alert on statistical outliers, particularly bursts of unique username values.
Correlate enumeration bursts with subsequent password-spray attempts against the same accounts to identify multi-stage attacks.

Monitoring Recommendations

Forward Kimai and reverse-proxy logs to a centralized analytics platform for retention and query.
Track response time distributions on authentication endpoints and alert when clients appear to be sampling latency systematically.
Monitor for requests originating from anonymization networks or cloud provider ranges targeting the Kimai login surface.

How to Mitigate CVE-2026-80199

Immediate Actions Required

Upgrade Kimai to version 2.54.0 or later, which addresses the timing discrepancy in TokenAuthenticator.
Place the Kimai application behind a reverse proxy or WAF that enforces per-IP rate limits on authentication endpoints.
Audit existing accounts and enforce strong password policies plus multi-factor authentication where supported to reduce follow-on risk.

Patch Information

The fix is available in Kimai 2.54.0. Details are published in the GitHub Security Advisory GHSA-jrc6-fmhw-fpq2. Administrators running self-hosted deployments should follow the standard Kimai upgrade procedure and validate that the upgrade completes without leaving prior versions accessible on shared infrastructure.

Workarounds

Restrict access to the Kimai API and login endpoints to trusted networks or VPN clients until the upgrade is applied.
Deploy WAF rules that throttle requests carrying the X-AUTH-USER header and block clients that exceed a low request-per-minute threshold.
Add a network-level rate limiter such as nginxlimit_req_zone in front of Kimai to slow enumeration attempts.

bash

# Example nginx rate limit for Kimai authentication endpoints
limit_req_zone $binary_remote_addr zone=kimai_auth:10m rate=10r/m;

server {
    location /api/ {
        limit_req zone=kimai_auth burst=5 nodelay;
        proxy_pass http://kimai_backend;
    }
}