Critical Kimai Docker Vulnerability Demands Urgent Update

Kimai users are urged to update their Docker installations after a critical security flaw was uncovered. This vulnerability allows attackers to forge authentication cookies, potentially compromising user accounts, including those with super administrator privileges.

Affected Versions and Resolution

The flaw, identified as CVE-2026-52824, impacts versions 2.57.0 and earlier of Kimai. An update to version 2.58.0 addresses this issue. Kimai, an open-source time-tracking tool, is commonly deployed via Docker containers, which are affected by this security lapse.

The vulnerability emerges from a default setting for the APP_SECRET environment variable, which was not automatically replaced during deployment, leaving installations exposed.

Exploitation Details

The default APP_SECRET value, “change_this_to_something_unique,” was publicly known and intended to be replaced. However, the Docker setup process did not enforce this, allowing potential misuse. This secret is crucial in generating security tokens and cookies for Kimai.

With the default secret in place, attackers could create valid tokens to impersonate users, including those with administrator rights, by exploiting predictable user IDs.

Mitigation and Recommendations

To mitigate this risk, users should update to Kimai version 2.58.0 or later, which introduces a new Docker initialization process. This new process generates a secure, random APP_SECRET if none is provided, thus enhancing system security.

Additional security measures include enabling two-factor authentication, updating credentials, and reviewing account settings. The GitHub advisory further recommends removing the default secret and increasing entropy in login links.

The vulnerability underscores the importance of secure defaults in software deployment. Organizations should address this issue promptly, given the potential for remote exploitation.

Security researcher AzureADTrent reported this vulnerability, classified under CWE-1188, “Initialization of a Resource with an Insecure Default.” Immediate action is advised to safeguard against potential attacks.