# CVE-2026-80196: Kimai authentication bypass in password reset link

Source: https://junglewise.ai/threats/cve-2026-80196-kimai-authentication-bypass-in-password-reset-link  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80196 · Severity: high · CVSS 7.5 · Published 2026-08-26

Kimai is a time tracking and project management application used by organizations to manage employee hours and project billing. A flaw in its password reset mechanism allows attackers who intercept or cache a password reset link to log in to user accounts multiple times even after the legitimate user has changed their password, effectively bypassing the password change security measure.

Technologies: [Kimai](https://junglewise.ai/threats/technologies/kimai), [kimai/kimai (Packagist)](https://junglewise.ai/threats/technologies/kimai-kimai). Vendors: [Kimai](https://junglewise.ai/threats/vendors/kimai), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-80196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80196 being exploited in the wild.

**How severe is CVE-2026-80196?** High severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** Kimai before 2.58.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.58.0.

**Is there a fix for CVE-2026-80196?** Yes. kimai/kimai (Packagist): upgrade to 2.58.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80196 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-80196?** Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kimai/kimai (Packagist): upgrade to 2.58.0 or later

  ```sh
  composer require kimai/kimai:^2.58.0
  ```


## Technical details

The vulnerability exists in Kimai's LoginLink signature generation for password reset URLs, which covers only the user ID and not the password hash. After a user successfully resets their password via a link, that same link remains valid for up to 2 additional uses within a 1-hour window due to Symfony's LoginLinkHandler allowing 3 total uses per link. An attacker who intercepts the reset link can authenticate as the user even after the legitimate user has changed their password, bypassing the forced-password-reset wizard on subsequent uses. The fix involves including the password hash in the signature generation, which invalidates the link once the user changes their password. No authentication is required to use an intercepted link; the attack is purely network-based.

## Affected products

- Kimai Kimai before 2.58.0

## Identifiers

- CVE-2026-80196
- GHSA-m492-gv72-xvxj

## Timeline

- 2026-05-27: disclosed: GitHub Security Advisory GHSA-m492-gv72-xvxj published
- 2026-08-26: advisory: CVE-2026-80196 published on NVD
- 2026: patched: Fix released in Kimai 2.58.0

## References

- [https://github.com/kimai/kimai/security/advisories/GHSA-m492-gv72-xvxj](https://github.com/kimai/kimai/security/advisories/GHSA-m492-gv72-xvxj)
- [https://www.vulncheck.com/advisories/kimai-before-2.58.0-authentication-bypass-via-password-reset-link](https://www.vulncheck.com/advisories/kimai-before-2.58.0-authentication-bypass-via-password-reset-link)

## Related threats

- [Kimai missing authorization check in ExportController export templates](https://junglewise.ai/threats/cve-2026-52828-kimai-missing-authorization-check-in-exportcontroller-export)
- [Kimai 2FA bypass in REST API via session cookie replay](https://junglewise.ai/threats/cve-2026-52827-kimai-2fa-bypass-in-rest-api-via-session-cookie-replay)
- [Kimai improper authorization in rate edit endpoints](https://junglewise.ai/threats/cve-2026-52826-kimai-improper-authorization-in-rate-edit-endpoints)
- [Kimai improper authorization in Team assignment APIs](https://junglewise.ai/threats/cve-2026-52825-kimai-improper-authorization-in-team-assignment-apis)
- [Kimai insecure default APP_SECRET in Docker image](https://junglewise.ai/threats/cve-2026-52824-kimai-insecure-default-app-secret-in-docker-image)