CVE-2026-52824

Kimai, an open-source time-tracking application, shipped its official Docker image with APP_SECRET set to the well-known public value 'change_this_to_something_unique', and the entrypoint script neither replaced nor rejected that value before Symfony used it as the kernel secret. An unauthenticated remote attacker who reaches a Docker deployment where the operator did not override APP_SECRET can use the known secret to forge HMAC-protected authentication artifacts, including KIMAI_REMEMBER cookies and login links. The attack additionally requires knowing a valid username, correctly guessing the associated account ID, and targeting an account without active two-factor authentication, after which the attacker gains access to that account without its password. All Docker-based Kimai deployments prior to version 2.58.0 that kept the default secret are affected; the fix in 2.58.0 generates and persists a random secret when no safe operator-provided value exists. No public proof-of-concept is known and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Upgrade to Kimai 2.58.0 or later, which auto-generates and persists a random APP_SECRET. If immediate upgrade is not possible, explicitly set APP_SECRET to a long random value via environment variable or compose file and restart the container, which also invalidates any previously forged remember-me cookies and login links. Operators should review authentication logs for anomalous logins tied to account IDs that did not use passwords, and enable two-factor authentication, which blocks this attack path.