Is CVE-2026-80199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80199 being exploited in the wild.

How severe is CVE-2026-80199?

Low severity, with a CVSS score of 3.7, published 26 August 2026.

Which products and versions are affected?

Kimai before 2.54.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.54.0.

Is there a fix for CVE-2026-80199?

Yes. kimai/kimai (Packagist): upgrade to 2.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80199 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-80199?

Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80199: Kimai TokenAuthenticator username enumeration via timing oracle

CVE-2026-80199 · Severity: low · CVSS 3.7 · Published 2026-08-26

Kimai is a time-tracking and billing application used by organizations to manage employee work hours. The authentication system leaks information about whether a username exists through measurable differences in response time, allowing attackers to discover valid user accounts without credentials. This weakens security by enabling attackers to build a list of real users to target with password attacks.

Technologies: Kimai, kimai/kimai (Packagist). Vendors: Kimai, Packagist.

Quick answers

Is CVE-2026-80199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80199 being exploited in the wild.
How severe is CVE-2026-80199?: Low severity, with a CVSS score of 3.7, published 26 August 2026.
Which products and versions are affected?: Kimai before 2.54.0; kimai/kimai (Packagist) ECOSYSTEM:introduced=0,fixed=2.54.0.
Is there a fix for CVE-2026-80199?: Yes. kimai/kimai (Packagist): upgrade to 2.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80199 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-80199?: Check whether you run Kimai or kimai/kimai (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

kimai/kimai (Packagist): upgrade to 2.54.0 or later
```
composer require kimai/kimai:^2.54.0
```

Technical details

A timing oracle vulnerability exists in TokenAuthenticator.php where the password hasher (argon2id) is only invoked when a user is found via loadUserByIdentifier(). When a non-existent username is queried, the response returns approximately 25 ms faster than for a valid username, despite returning identical HTTP 403 responses with the same error message. The legacy X-AUTH-USER and X-AUTH-TOKEN headers accept unauthenticated requests to the /api/* endpoints with no login throttling, allowing unbounded probing. An attacker can enumerate valid usernames by measuring response times from the /api/users/me endpoint. The vulnerability is fixed in version 2.54.0 by running the password hasher against a fixed dummy hash even when the user is not found, ensuring constant-time responses regardless of user existence.

Affected products

Kimai Kimai before 2.54.0

Identifiers

CVE-2026-80199
GHSA-jrc6-fmhw-fpq2

Timeline

2026-04-16: disclosed
2026-08-25: advisory
2026-04-16: patched: patched in version 2.54.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.