Insecure Default Initialization of Resource Affecting kimai/kimai package, versions <2.58.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-KIMAIKIMAI-17971334
- published14 Jul 2026
- disclosed14 Jul 2026
- creditUnknown
Introduced: 14 Jul 2026
NewCVE-2026-52824 (opens in a new tab)How to fix?
Upgrade kimai/kimai to version 2.58.0 or higher.
Overview
Affected versions of this package are vulnerable to Insecure Default Initialization of Resource through the use of a default APP_SECRET value in the Docker deployment process. An attacker can gain unauthorized access to any user account, including administrative accounts, by forging authentication cookies and login links if the default secret is not changed. This is only exploitable if the application is deployed using the official Docker image without overriding the default APP_SECRET, the attacker knows or can guess a valid username and account ID, and the target account does not have two-factor authentication enabled.