Open-Source Time Tracking Application Vulnerability Exposes User Accounts

CVE-2026-52824

What is CVE-2026-52824?

Kimai, an open-source time tracking application, suffered from a security oversight where the Docker image set APP_SECRET to a publicly known value, 'change_this_to_something_unique'. As a result, if a deployment was not properly configured and utilized this default value, an attacker could exploit this flaw. By knowing a username and guessing the corresponding account ID, the attacker could perform unauthorized actions without the user's password, assuming two-factor authentication was not enabled. The issue has been addressed in version 2.58.0, which now ensures that a secure, random secret is generated when no operator-defined value is provided.

References