CVE-2026-52824: Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_thi

Executive brief

Kimai is an open-source time-tracking application. A security vulnerability exists in its official Docker deployment where a publicly known secret key is used by default. An attacker can use this known key to forge authentication credentials and take over any user account, including administrative accounts, potentially leading to full data exposure and service compromise.

Technical details

The official Kimai Docker image ships with a hardcoded default environment variable 'APP_SECRET=change_this_to_something_unique'. This value is used as the Symfony 'kernel.secret' to HMAC-sign sensitive tokens, including 'KIMAI_REMEMBER' cookies, LoginLink signatures, password reset URLs, and CSRF tokens. Because the Docker entrypoint does not validate or force a change to this secret, an unauthenticated remote attacker can forge these signatures. By combining the known secret with predictable sequential User IDs, an attacker can gain unauthorized access to any account that does not have 2FA enabled. The issue is fixed in version 2.58.0 by removing the default secret and implementing automatic secret generation in the entrypoint script.

Affected products

• Kimai Kimai <= 2.57.0

Timeline

• 2026-06-11: disclosed
• 2026-07-14: advisory
• 2026-07-14: patched

References

• https://api.github.com/users/AzureADTrent
• https://github.com/AzureADTrent
• https://api.github.com/users/AzureADTrent/gists%7B/gist_id%7D
• https://api.github.com/users/AzureADTrent/repos
• https://avatars.githubusercontent.com/u/8278208?v=4
• https://api.github.com/users/AzureADTrent/events%7B/privacy%7D