CVE-2026-52827: Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before T

Executive brief

Kimai is an open-source time-tracking application used by businesses to manage projects and billing. A security flaw allows an attacker who has stolen a user's password to completely bypass two-factor authentication (2FA) when accessing the system's programming interface (API). This means that even if a user has 2FA enabled to protect their account, an attacker can still access and modify their data using only their password.

Technical details

A vulnerability in Kimai's API firewall allows for a full bypass of two-factor authentication (TOTP). The root cause is that the 'KIMAI_SESSION' cookie, which is issued immediately after a successful password verification but before the 2FA step, is incorrectly treated as fully authenticated by the REST API endpoints. The API firewall was configured to accept the 'IS_AUTHENTICATED' role, which is satisfied by the 'TwoFactorToken' generated during the 2FA transition. An attacker with valid user credentials can capture this session cookie and replay it against any '/api/*' endpoint to perform actions as the user without providing the second factor. This has been fixed in version 2.59.0 by requiring the 'IS_AUTHENTICATED_REMEMBERED' role for API access.

Affected products

• Kimai Kimai < 2.59.0

Timeline

• 2026-06-29: disclosed
• 2026-07-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/shafiqaimanx
• https://github.com/shafiqaimanx
• https://api.github.com/users/shafiqaimanx/gists%7B/gist_id%7D
• https://api.github.com/users/shafiqaimanx/repos
• https://avatars.githubusercontent.com/u/65850328?v=4
• https://api.github.com/users/shafiqaimanx/events%7B/privacy%7D