Kimai CVE-2026-52824 — Default APP_SECRET Authentication Bypass

Note: The repository URL contains an outdated CVE ID (CVE-2026-49865). The correct and current CVE tracked in this repository is CVE-2026-52824 (GHSA-jr9p-4h4j-6c58).

Proof-of-concept exploit toolkit for the hardcoded default APP_SECRET vulnerability in Kimai time-tracking (versions ≤ 2.57.0). Allows authentication bypass via forged KIMAI_REMEMBER cookies on unpatched Docker deployments.

The Story

When CVE-2026-52824 dropped — a CVSS 9.1 critical with a hardcoded default secret sitting in a Docker image used by thousands of self-hosters — the technical community knew about it, and the fix shipped in 2.58.0. But nobody published a working proof-of-concept.

So I rebuilt it from the advisory alone.

The chain: Kimai ships APP_SECRET=change_this_to_something_unique in Docker and .env.dist. In v2.57.0 the signature_properties for remember-me cookies is empty, so the FieldsHash collapses to a constant (SHA256('')). Combine the known secret with an empty hash and you can forge a KIMAI_REMEMBER cookie for any user id — including admin (id:1).

This repo is the complete working toolkit that goes from advisory to admin session on any unpatched instance.

Vulnerability Summary

How It Works

Kimai ships with a hardcoded default APP_SECRET in its Docker image and .env.dist:

APP_SECRET=change_this_to_something_unique

In v2.57.0, the signature_properties for remember-me cookies is empty, making the FieldsHash a constant (SHA256('')). Combined with the known secret, anyone can forge a valid KIMAI_REMEMBER cookie for any user — including admin.

Attack Chain

1. Identify a Kimai instance running ≤ 2.57.0
2. User IDs are sequential (admin = id:1)
3. Known APP_SECRET → compute HMAC-SHA256 signatures
4. Forge KIMAI_REMEMBER cookie with admin's user_id + username
5. Server validates HMAC → full admin session
6. Admin access enables timesheet manipulation, user creation, and potential RCE

What Changed in v2.58.0

Toolkit Contents

Installation

git clone https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC.git
cd Kimai-CVE-2026-49865-POC
pip install -r requirements.txt

Usage

Single Target Exploit

python3 exploit.py https://kimai.example.com
python3 exploit.py https://kimai.example.com admin --dump

Batch Exploitation

# From a file of URLs
python3 batch_pwn.py kimai_hosts.txt results.txt 30

Shodan Discovery

export SHODAN_API_KEY="your_key"
python3 shodan-scanner.py --search --output kimai_hosts.txt

Version Probing

python3 deep_probe.py kimai_hosts.txt versioned_results.txt
python3 quick_scan.py hosts_file.txt

Requirements

• Python 3.8+
• requests — HTTP client
• shodan — Shodan API client (only for shodan-scanner.py)

Disclaimer

This toolkit is provided for authorized security testing and research only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing. The author assumes no liability for misuse.

License

MIT idk iam tired ok thx