Executive brief
Kimai is a time-tracking and project management web application that supports SAML-based single sign-on authentication. An attacker with access to a SAML identity provider can craft a malicious redirect that sends authenticated users to an attacker-controlled website after they log in, enabling credential theft or phishing attacks. This requires the victim to initiate login through an IdP-initiated SSO flow and the attacker to have control over the SAML identity provider configuration.
Technical details
The vulnerability is an open redirect (CWE-601) in the SAML authentication success handler (src/Saml/Security/SamlAuthenticationSuccessHandler.php) where the RelayState POST parameter is accepted as a redirect destination without validating the host or scheme. The vulnerable code only checks that RelayState does not equal the configured login_path, allowing any external URL to be used as a redirect target. An attacker with IdP access can supply a malicious RelayState value in an IdP-initiated SSO flow to redirect users post-authentication. The vulnerability was patched in version 2.53.0, which validates RelayState to ensure it contains no host/port, does not start with //, and if it contains a host, that host matches the current request host.
Affected products
- Kimai Kimai before 2.53.0
Timeline
- 2026-04-11: disclosed
- 2026-04-11: patched: Fixed in version 2.53.0
- 2026-08-26: advisory