Timing Oracle Vulnerability in Kimai by Kimai Project
CVE-2026-80199

6.3MEDIUM

Key Information:

Vendor

Kimai

Status
Kimai
Vendor
CVE Published:
25 August 2026

What is CVE-2026-80199?

In Kimai versions prior to 2.54.0, a timing oracle vulnerability exists in the TokenAuthenticator component. This flaw permits unauthenticated attackers to execute username enumeration by leveraging response time disparities related to the X-AUTH-USER header. Specifically, if the password hash function is invoked solely for existing usernames, attackers can deduce valid usernames based on variations in response times, effectively bypassing any protections against login attempts.

Affected Version(s)

kimai 0 < 2.54.0

kimai 2.54.0

References

https://github.com/kimai/kimai/security/advisories/GHSA-j...
vendor-advisory
https://www.vulncheck.com/advisories/kimai-before-2.54.0-...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

melnicek
.