Description

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-26T05:18:27.530Z",
  "pubdate": "2026-08-26T05:18:27.530Z",
  "executiveSummary": "Kimai versions prior to 2.54.0 are susceptible to a timing oracle vulnerability within the TokenAuthenticator component.\nThis vulnerability allows unauthenticated attackers to perform username enumeration by analyzing response latency variations triggered by the application's password hashing process.\nThe core of the issue resides in the conditional execution of cryptographic functions based on the validity of the provided username in the X-AUTH-USER header.\nBecause the application performs expensive password hashing only when a valid username is detected, the resulting time discrepancy serves as a side-channel signal for attackers to confirm the existence of specific user accounts.\nThis flaw is particularly dangerous as it lacks native login throttling protections, enabling automated, high-speed enumeration of the user directory.\nSuccessful exploitation exposes the underlying user structure, which significantly facilitates subsequent brute-force attacks or targeted credential stuffing campaigns against the identified user base.",
  "technicalDetails": "The vulnerability originates in the TokenAuthenticator logic, which fails to implement constant-time verification for authentication attempts.\nWhen an unauthenticated attacker transmits a request containing the X-AUTH-USER header, the application initiates an authentication check.\nThe root cause is a branching execution path where the application attempts to resolve the username provided in the header; if the username exists in the database, the system proceeds to invoke the password hasher.\nThe execution of the password hashing algorithm introduces a measurable computational delay that is absent when the system immediately rejects an invalid username.\nAttackers can leverage this side-channel by measuring the time-to-first-byte (TTFB) or total response duration with high precision, allowing them to differentiate between existing and non-existing accounts based on the latency delta.\nThe attack flow follows a structured pattern: first, the attacker generates a list of potential usernames or targets; second, the attacker iterates through this list, sending repeated HTTP requests with the X-AUTH-USER header set to the target username.\nBy collecting statistical samples of response times for each username, the attacker can filter out network jitter to reliably identify valid entries.\nSince the current implementation of the TokenAuthenticator does not incorporate rate limiting or login throttling mechanisms, attackers can perform these measurements at scale without triggering security blocks.\nThe vulnerability is present in the authentication flow of all versions of Kimai preceding 2.54.0.\nExposure is global, as the authentication interface is typically reachable over the network via standard HTTP/HTTPS protocols, requiring no prior authentication or specific privileges for the enumeration phase.\nPost-exploitation, the attacker gains a verified list of valid usernames, which serves as a critical prerequisite for advanced attacks, such as targeted credential stuffing or password spraying, effectively bypassing the first layer of defensive obscurity regarding user identities."
}