Skip to content
OpenAdvisories

Package · Packagist

kimai/kimai

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-52824 Public exploit Scanner template

    Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

    Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony u…

    Kimai Project kimai kimai/kimai Packagist