Description
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kimai | kimai | < 2.54.0 | 2.54.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | kimai/kimai | < 2.54.0 | 2.54.0 | GHSA-jrc6-fmhw-fpq2 |
References
- GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2) vendor-advisory
- VulnCheck Advisory: Kimai before 2.54.0 Username Enumeration via Timing Oracle third-party-advisory