Kimai username enumeration via timing in TokenAuthenticator

Executive brief

Kimai, an open-source time-tracking application, contains a vulnerability that allows unauthorized individuals to determine if specific usernames exist on the system. By measuring the time the server takes to respond to login attempts, an attacker can distinguish between valid and invalid accounts. While this does not grant direct access to accounts, it provides a list of valid targets for further password-guessing or phishing attacks.

Technical details

The vulnerability exists in `src/API/Authentication/TokenAuthenticator.php` due to an observable timing discrepancy (CWE-208). The application calls `loadUserByIdentifier()` and only executes the computationally expensive Argon2id password hashing if a user is found. Requests for non-existent users return approximately 25ms faster than those for existing users. This timing oracle is accessible via the legacy `X-AUTH-USER` and `X-AUTH-TOKEN` headers on the `/api/*` firewall, which lacks login throttling. Attackers can use this to perform unbounded username enumeration without prior authentication. The issue is addressed in version 2.54.0 by ensuring the password hasher runs against a dummy hash when a user is not found.

Affected products

• Kimai kimai/kimai <= 2.53.0

Timeline

• 2026-04-16: disclosed: Advisory published by maintainer.
• 2026-04-17: advisory: GitHub Advisory Database entry created.

References

• https://api.github.com/users/melnicek
• https://github.com/melnicek
• https://api.github.com/users/melnicek/gists%7B/gist_id%7D
• https://api.github.com/users/melnicek/repos
• https://avatars.githubusercontent.com/u/41522529?v=4
• https://api.github.com/users/melnicek/events%7B/privacy%7D