Kimai weak password recovery mechanism allows link reuse after reset

Executive brief

Kimai is an open-source time-tracking application. A security issue was identified where password reset links remain valid for up to an hour even after a user has already successfully changed their password. This could allow an attacker who intercepts the link (e.g., through email scanners or browser history) to gain unauthorized access to a user's account, even if the user believes they have secured it.

Technical details

A vulnerability exists in Kimai's password reset mechanism where the LoginLink signature only includes the user's ID and not the password hash. Consequently, the HMAC signature remains valid after a password change. The system is configured to allow up to 3 uses of a link within a 3600-second (1 hour) window. An attacker who obtains a reset link—via email relay scanners, shared inboxes, or browser history—can use it to bypass authentication and gain a session even after the legitimate user has completed the reset process. This has been patched in version 2.58.0 by including the password hash in the signature generation.

Affected products

• Kimai Kimai <= 2.57.0

Timeline

• 2026-05-27: disclosed
• 2026-07-01: advisory: GitHub Advisory published

References

• https://api.github.com/users/AzureADTrent
• https://github.com/AzureADTrent
• https://api.github.com/users/AzureADTrent/gists%7B/gist_id%7D
• https://api.github.com/users/AzureADTrent/repos
• https://avatars.githubusercontent.com/u/8278208?v=4
• https://api.github.com/users/AzureADTrent/events%7B/privacy%7D