CVE-2026-52824: Default Docker Secret in Kimai Enables Account Takeover of Super Admin Accounts

TL;DR

A critical Kimai vulnerability, CVE-2026-52824 (CVSS 9.1), affects the open-source time-tracking app’s official Docker image. The image shipped with a publicly known default APP_SECRET, letting an unauthenticated attacker forge signed cookies and hijack accounts. Version 2.58.0 fixes the flaw. A proof-of-concept was created but withheld for security reasons, and no in-the-wild exploitation has been confirmed.

Why It Matters

Kimai serves freelancers and companies with hundreds of users. Its Docker image is a popular deployment path, so many instances inherit the weak default. Any affected instance reachable from the internet is at risk. Worse, the account takeover can target super_admin, since user IDs are sequential integers starting at 1.

How the Attack Works

The Dockerfile set APP_SECRET to a placeholder sentinel value. Symfony consumes that value as kernel.secret, which HMAC-signs remember-me cookies, login links, password reset URLs, and CSRF tokens. Because the entrypoint never replaced or validated the sentinel, the signing key stayed public. An attacker who knows a username, guesses the matching account ID, and finds no active 2FA can forge authentication tokens. Notably, active two-factor authentication blocks this path.

Affected Versions

The Kimai vulnerability affects all versions up to and including 2.57.0. Bare-metal installs using the shipped .env.dist default face the same exposure.

Patch and Mitigation Steps

Upgrade to Kimai 2.58.0 from the official releases page. The new entrypoint generates a random secret and removes the hardcoded default. Meanwhile, set a unique APP_SECRET yourself and rotate it if you ran the old default. Enabling 2FA adds another barrier. Full technical details appear in the Kimai security advisory.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.