Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass
CVE-2026-52824
Verified
Description
Kimai Docker images <= 2.57.0 ship with a hardcoded APP_SECRET of "change_this_to_something_unique". This default secret is used by Symfony's SignatureHasher to HMAC-sign login links and remember-me cookies. An unauthenticated attacker who knows this default secret can forge valid authentication tokens and hijack any user account, including the super-admin.
Severity
Critical
CVSS Score
9.1
Exploit Probability
1%
Affected Product
kimai
Published Date
July 20, 2026
Template Author
dhiyaneshdk
CVE-2026-52824.yaml
9.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID:
cve-2026-52824
CWE ID:
cwe-1188
Remediation Steps
Upgrade to Kimai >= 2.58.0 which generates a random APP_SECRET on first boot. Alternatively, manually set a unique APP_SECRET in your .env.local file.