Description

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T05:18:27.083Z",
  "pubdate": "2026-08-26T05:18:27.083Z",
  "executiveSummary": "Kimai versions prior to 2.58.0 are susceptible to an authentication bypass vulnerability stemming from flawed password reset link validation.\nThe vulnerability allows an attacker to reuse a captured or cached password reset link even after the victim has successfully updated their credentials.\nThis flaw exists because the cryptographic signature of the LoginLink is insufficiently bound to the user's current security state, specifically omitting the password hash from the validation scope.\nConsequently, an attacker possessing an intercepted link can maintain unauthorized access to the victim's account for up to one hour after the password change, provided the link's time-to-live window has not expired.\nThis represents a significant security risk, potentially leading to unauthorized account access, data exfiltration, or administrative privilege escalation depending on the victim's role within the Kimai installation.\nExploitation is contingent upon the attacker's ability to intercept the initial password reset token, typically through network sniffing, log access, or browser caching on a shared machine.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient cryptographic binding of the LoginLink signature within the Kimai authentication framework. Specifically, the signature generation process for password reset links relies exclusively on the user ID identifier.\nBy failing to incorporate the user's password hash—or a unique security stamp derived from the password hash—into the signature payload, the application fails to invalidate existing tokens upon a change of user credentials.\nIn a secure implementation, a password reset token should be cryptographically linked to the user's current password hash. When a user updates their password, the hash changes, effectively invalidating any previously issued tokens that were signed using the old hash.\nIn the vulnerable versions of Kimai, the absence of this validation check allows for an authentication bypass flow: First, an attacker intercepts a valid password reset link intended for a user. Second, the legitimate user completes the password change process, which should logically revoke all pending password reset sessions.\nHowever, due to the flawed validation logic, the application continues to verify the intercepted LoginLink by checking only the integrity of the user ID within the signature. Because the signature remains valid, the application accepts the token as a legitimate authentication request.\nThe vulnerability is further exacerbated by the one-hour validity window configured for these links. During this period, an attacker can utilize the same link up to two additional times to establish an authenticated session as the victim. This allows the attacker to bypass the password reset security mechanism entirely, maintaining access despite the victim's proactive measures to secure their account.\nThe impact includes persistent unauthorized access to the application, allowing an attacker to interact with the system under the identity of the victim. If the compromised account possesses administrative privileges, the attacker could potentially modify system configurations, access sensitive project data, or create additional persistent backdoors within the application environment. The requirement for interaction is low, provided the attacker has previously cached or intercepted the communication containing the reset URL."
}