{"id":"CVE-2026-52824","title":"Kimai is an open-source time tracking application","summary":"Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that …","severity":"critical","cvss":9.1,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-1188"],"vendor":"kimai","product":"kimai","affected":["kimai < 2.58.0"],"patched":["kimai/kimai 2.58.0"],"published":"2026-09-15","updated":"2026-09-16","sourceUpdated":"2026-09-16T18:17:09.763","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52824","references":[{"url":"https://github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601","label":"security-advisories@github.com"},{"url":"https://github.com/kimai/kimai/pull/5952","label":"security-advisories@github.com"},{"url":"https://github.com/kimai/kimai/releases/tag/2.58.0","label":"security-advisories@github.com"},{"url":"https://github.com/kimai/kimai/security/advisories/GHSA-jr9p-4h4j-6c58","label":"security-advisories@github.com"},{"url":"https://www.kimai.org/en/security/ghsa-jr9p-4h4j-6c58","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-jr9p-4h4j-6c58"}],"tags":["nvd","exploit-available","cve.org","ghsa","composer"],"epss":0.02062,"epssPercentile":0.80232,"exploits":{"github":1,"githubRepos":["https://github.com/AzureADTrent/CVE-2026-52824"],"nuclei":["CVE-2026-52824"],"checkedAt":"2026-09-21T15:29:24.622Z"},"exploitAvailable":true,"aliases":["GHSA-jr9p-4h4j-6c58"],"ecosystem":"composer","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-16T17:32:52.166965Z"},"cvssSource":"cna","ingestedAt":"2026-07-14T00:31:48.484Z","slug":"CVE-2026-52824","body":"## Overview\n\nKimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated attacker who reaches a deployment that did not override APP_SECRET, knows a username, correctly guesses the account ID associated with that username, and targets an account without active two-factor authentication can forge HMAC-protected authentication artifacts, including KIMAI_REMEMBER cookies and login links, to access the account without its password. The updated entrypoint generates and persists a random secret when no safe operator-provided value exists. This issue is fixed in version 2.58.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52824)\n\nAffected packages:\n\n- `kimai/kimai <= 2.57.0`\n\nPatched in:\n\n- `kimai/kimai 2.58.0`\n\nSource: https://github.com/advisories/GHSA-jr9p-4h4j-6c58","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":203573,"id":"CVE-2026-52824","ts":1789472201800,"field":"cvss","old":null,"new":"9.1"},{"seq":5304,"id":"CVE-2026-52824","ts":1788887264141,"field":"exploit_available","old":"false","new":"true"},{"seq":4187,"id":"CVE-2026-52824","ts":1788886378934,"field":"exploit_available","old":"true","new":"false"},{"seq":2948,"id":"CVE-2026-52824","ts":1788883043751,"field":"exploit_available","old":"false","new":"true"},{"seq":1977,"id":"CVE-2026-52824","ts":1788882448230,"field":"exploit_available","old":"true","new":"false"},{"seq":1063,"id":"CVE-2026-52824","ts":1788881883870,"field":"exploit_available","old":"false","new":"true"}]}