CVE-2026-52827: Kimai REST API Vulnerability Allows Bypass of Two-Factor Authentication
Summary
CVE-2026-52827: Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP. Affects kimai/kimai versions < 2.59.0. Fixed in 2.59.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kimai is an open-source time-tracking software that allows users to manage their time and projects efficiently. It supports various features such as invoicing, reporting, and user management. However, a critical vulnerability has been identified in its authentication mechanism, specifically affecting the REST API when two-factor authentication (2FA) is enabled.
Vulnerability Detail
The vulnerability arises from the handling of the KIMAI_SESSION cookie during the login process. After a user enters their password, the session cookie is issued before the two-factor authentication step is completed. This cookie can be used to access the REST API without requiring the second factor, effectively bypassing 2FA. This flaw allows attackers who obtain a user's password to gain full authenticated access to the API, undermining the security that 2FA is supposed to provide. The issue is rooted in the API's authorization logic, which incorrectly grants access based on the session cookie without verifying if the 2FA step has been completed.
How To Fix
Minimum fixed version
2.59.0
This is the first release that contains the fix.
composer require kimai/kimai:2.59.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the REST API access for users who have 2FA enabled until the patch is applied. This can be done by modifying the API access settings in your configuration files.
Conclusion
The CVE-2026-52827 vulnerability in Kimai poses a significant risk to users who have enabled two-factor authentication. It allows attackers to bypass this security measure and gain unauthorized access to the REST API. Immediate action is recommended to update the software to the patched version to mitigate this risk.
See every vulnerability recorded for kimai/kimai →
FAQ
CVE-2026-52827 is a vulnerability in Kimai that allows attackers to bypass two-factor authentication for the REST API using a session cookie.
If your Kimai installation has 2FA enabled, this vulnerability allows an attacker with a user's password to access the API without needing the second authentication factor.
If an immediate update is not possible, consider disabling API access for users with 2FA enabled as a temporary measure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for kimai/kimai.
