Kimai CVE-2026-52824 — Default APP_SECRET Authentication Bypass

Note: The repository URL contains an outdated CVE ID (CVE-2026-49865). The correct and current CVE tracked in this repository is CVE-2026-52824 (GHSA-jr9p-4h4j-6c58).

Proof-of-concept exploit toolkit for the hardcoded default APP_SECRET vulnerability in Kimai time-tracking (versions ≤ 2.57.0). Allows authentication bypass via forged KIMAI_REMEMBER cookies on unpatched Docker deployments.

The Story

When CVE-2026-52824 dropped — a CVSS 9.1 critical with a hardcoded default secret sitting in a Docker image used by thousands of self-hosters — the technical community knew about it, and the fix shipped in 2.58.0. But nobody published a working proof-of-concept.

So I rebuilt it from the advisory alone.

The chain: Kimai ships APP_SECRET=change_this_to_something_unique in Docker and .env.dist. In v2.57.0 the signature_properties for remember-me cookies is empty, so the FieldsHash collapses to a constant (SHA256('')). Combine the known secret with an empty hash and you can forge a KIMAI_REMEMBER cookie for any user id — including admin (id:1).

This repo is the complete working toolkit that goes from advisory to admin session on any unpatched instance.

Vulnerability Summary

Field	Value
CVE	CVE-2026-52824
GHSA	GHSA-jr9p-4h4j-6c58
CVSS	9.1 (Critical)
CWE	CWE-1188 — Insecure Default Resource Initialization
Affected	Kimai ≤ 2.57.0 (Docker image / `.env.dist`)
Fixed	2.58.0
Credit	Trent M. (`AzureADTrent`)

How It Works

Kimai ships with a hardcoded default APP_SECRET in its Docker image and .env.dist:

APP_SECRET=change_this_to_something_unique

In v2.57.0, the signature_properties for remember-me cookies is empty, making the FieldsHash a constant (SHA256('')). Combined with the known secret, anyone can forge a valid KIMAI_REMEMBER cookie for any user — including admin.

Attack Chain

Identify a Kimai instance running ≤ 2.57.0
User IDs are sequential (admin = id:1)
Known APP_SECRET → compute HMAC-SHA256 signatures
Forge KIMAI_REMEMBER cookie with admin's user_id + username
Server validates HMAC → full admin session
Admin access enables timesheet manipulation, user creation, and potential RCE

What Changed in v2.58.0

Aspect	v2.57.0 (Vulnerable)	v2.58.0 (Patched)
Dockerfile	`ENV APP_SECRET=change_this_to_something_unique`	No hardcoded default
entrypoint.sh	No secret generation	Generates `bin2hex(random_bytes(32))` on first boot
Storage	N/A	Persists in `/opt/kimai/var/data/.appsecret`

Toolkit Contents

File	Purpose
`exploit.py`	Single-target exploit — forges cookie and authenticates
`batch_pwn.py`	Multi-threaded batch exploitation against a list of hosts
`quick_scan.py`	Two-pass scanner — quick filter then deep probe
`deep_probe.py`	Version detection via multiple endpoints
`probe_batch.py`	Probe hosts from file for version + vulnerability
`shodan-scanner.py`	Shodan integration for discovering Kimai instances

Installation

git clone https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC.git
cd Kimai-CVE-2026-49865-POC
pip install -r requirements.txt

Usage

Single Target Exploit

python3 exploit.py https://kimai.example.com
python3 exploit.py https://kimai.example.com admin --dump

Batch Exploitation

# From a file of URLs
python3 batch_pwn.py kimai_hosts.txt results.txt 30

Shodan Discovery

export SHODAN_API_KEY="your_key"
python3 shodan-scanner.py --search --output kimai_hosts.txt

Version Probing

python3 deep_probe.py kimai_hosts.txt versioned_results.txt
python3 quick_scan.py hosts_file.txt

Requirements

Python 3.8+
requests — HTTP client
shodan — Shodan API client (only for shodan-scanner.py)

Disclaimer

This toolkit is provided for authorized security testing and research only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing. The author assumes no liability for misuse.

License

MIT idk iam tired ok thx

Kimai-CVE-2026-49865-POC — Updated!

Categories