Kimai open redirect in SAML ACS handler

Executive brief

Kimai, an open-source time-tracking application, is vulnerable to an open redirect when SAML authentication is enabled. An attacker can craft a malicious login link that, upon successful authentication, redirects the user to an external, untrusted website. This can be used in phishing campaigns to deceive users into providing credentials or session tokens to a fraudulent site that mimics the legitimate application.

Technical details

The SAML authentication success handler in `src/Saml/Security/SamlAuthenticationSuccessHandler.php` fails to validate the host or scheme of the `RelayState` parameter. The code only checks if the `RelayState` matches the configured login path; if it does not, it returns the value directly as a redirect destination. An attacker can exploit this in IdP-initiated SSO flows by supplying an absolute URL in the `RelayState` parameter. Successful exploitation requires SAML to be enabled and typically involves the attacker being able to influence the SAML request or having access to the IdP. The issue is fixed in version 2.53.0 by ensuring the redirect target does not contain an external host or port.

Affected products

• Kimai Kimai <= 2.52.0

Timeline

• 2026-04-11: disclosed: Initial disclosure by morimori-dev
• 2026-04-14: advisory: GitHub Advisory published
• 2026-04-14: patched: Fix released in version 2.53.0

References

• https://api.github.com/users/morimori-dev
• https://github.com/morimori-dev
• https://api.github.com/users/morimori-dev/gists%7B/gist_id%7D
• https://api.github.com/users/morimori-dev/repos
• https://avatars.githubusercontent.com/u/60306789?v=4
• https://api.github.com/users/morimori-dev/events%7B/privacy%7D