CVE-2026-80200: Kimai SAML Authentication Bypass Vulnerability

CVE-2026-80200 Overview

CVE-2026-80200 is an open redirect vulnerability in Kimai, an open-source time-tracking application, affecting versions prior to 2.53.0. The flaw resides in the SAML authentication success handler, which accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with access to the Identity Provider (IdP) can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs. The issue is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Successful exploitation redirects authenticated Kimai users to attacker-controlled destinations, enabling credential theft and phishing attacks against legitimate users of the application.

Affected Products

Kimai time-tracking application versions prior to 2.53.0
Deployments configured to use SAML single sign-on (SSO)
Self-hosted Kimai instances integrated with third-party Identity Providers

Discovery Timeline

2026-08-26 - CVE-2026-80200 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80200

Vulnerability Analysis

The vulnerability affects Kimai's SAML authentication success handler. After a user successfully authenticates through a SAML IdP, the handler consumes the RelayState parameter from the POST response and uses it as a redirect target. The application does not validate whether the destination URL points to a trusted host under its control.

This behavior allows an attacker who can influence the RelayState value to send an authenticated Kimai user to any external URL. Because the redirect occurs after a legitimate authentication flow, the target URL inherits perceived trust from the Kimai domain. Attackers typically weaponize this pattern by hosting a lookalike Kimai login page or a credential-harvesting form on the destination host.

Root Cause

The root cause is missing allowlist validation on the RelayState parameter within the SAML success handler. The application treats the parameter as a trusted redirect target instead of restricting redirects to same-origin or explicitly registered destinations. This is a canonical instance of CWE-601.

Attack Vector

Exploitation requires user interaction and network-based delivery of a crafted SAML flow. An attacker who controls or influences the IdP, or who can craft a SAML request that includes an arbitrary RelayState, delivers the link to a Kimai user. When the user completes authentication, Kimai forwards the browser to the attacker-supplied URL. The attacker then presents a spoofed login prompt or phishing content to capture credentials or session material. Refer to the GitHub Security Advisory GHSA-3jp4-mhh4-gcgr and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-80200

Indicators of Compromise

SAML authentication responses containing RelayState values pointing to external hosts not associated with the Kimai deployment
Web server access logs showing HTTP 302 redirects from the SAML ACS endpoint to unfamiliar external domains
User reports of unexpected login prompts appearing after signing into Kimai

Detection Strategies

Inspect Kimai and reverse proxy logs for SAML callback requests where the RelayState parameter encodes absolute URLs outside the application's own domain
Correlate IdP authentication events with subsequent outbound redirects to identify anomalous redirect targets
Alert on newly observed destination domains appearing in post-authentication redirects from the Kimai service

Monitoring Recommendations

Enable verbose logging on the SAML authentication endpoint to capture full RelayState values for review
Forward Kimai application logs and IdP logs to a centralized SIEM to enable cross-source correlation
Monitor for phishing domains that visually resemble the organization's Kimai hostname

How to Mitigate CVE-2026-80200

Immediate Actions Required

Upgrade Kimai to version 2.53.0 or later, which validates RelayState destinations against an allowlist
Audit SAML IdP configurations and restrict which parties can initiate SAML flows targeting the Kimai Assertion Consumer Service
Notify Kimai users of the phishing risk and instruct them to verify the browser address bar after authenticating

Patch Information

The maintainers released a fix in Kimai 2.53.0. See the GitHub Security Advisory GHSA-3jp4-mhh4-gcgr for release details and remediation guidance.

Workarounds

Place a reverse proxy in front of Kimai that strips or normalizes RelayState parameters to same-origin values
Temporarily disable SAML authentication and revert to local authentication until the upgrade is completed
Configure Content Security Policy and browser-side protections to reduce the effectiveness of downstream phishing pages

bash

# Example reverse proxy rule (nginx) to block external RelayState destinations
# Review and adapt to your environment before deploying
location /auth/saml/acs {
    if ($arg_RelayState ~* "^https?://(?!kimai\.example\.com)") {
        return 400;
    }
    proxy_pass http://kimai_backend;
}