CVE-2026-80199 in Kimai
Summary
by MITRE • 08/26/2026
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Kimai application prior to version 2.54.0 exhibits a critical timing oracle vulnerability within its TokenAuthenticator component, which fundamentally compromises the integrity of user authentication processes. This flaw arises from an inconsistent execution path in the password hashing mechanism during token-based authentication attempts. Specifically, when an attacker submits credentials via the X-AUTH-USER header, the system performs resource-intensive cryptographic operations only if the provided username corresponds to a valid account in the database. Conversely, for non-existent usernames, the application bypasses this computationally expensive step and returns immediately with an error response. This discrepancy creates a measurable difference in server response times that can be detected by external observers, effectively turning the authentication endpoint into a side-channel information leak.
This vulnerability enables unauthenticated attackers to perform username enumeration without triggering any login throttling or rate-limiting protections typically designed to prevent brute-force attacks. By sending multiple requests with varying usernames and precisely measuring the time taken for each response, an attacker can statistically determine which usernames are valid within the system. The reliability of this attack depends on network latency variability; however, in most controlled environments or through repeated sampling techniques, the timing difference is significant enough to distinguish between existing and non-existing users with high accuracy. This capability allows adversaries to build a list of legitimate user accounts, which serves as a crucial reconnaissance step for subsequent targeted attacks such as credential stuffing, password spraying, or social engineering campaigns.
From a classification perspective, this vulnerability aligns closely with CWE-208, which describes observable timing discrepancy in cryptographic operations, and falls under the broader category of CWE-613, insufficient session expiration. In terms of offensive security frameworks, it maps to ATT&CK technique T1595.001, Active Scanning: Vulnerability Scanning, specifically where attackers gather information about system configurations or user accounts through timing analysis rather than direct exploitation of a logic flaw that causes immediate failure. The lack of constant-time comparison for the username lookup is the root cause, as secure authentication implementations must ensure that processing time remains uniform regardless of whether the input matches existing records to prevent such side-channel leaks.
The operational impact of this vulnerability extends beyond simple user enumeration. By identifying valid usernames, attackers can significantly reduce the search space for brute-force attacks, thereby increasing their success rate while minimizing detection risk associated with high-volume failed login attempts from a single source. Furthermore, in environments where Kimai is integrated with other services or used by sensitive personnel such as project managers and developers, exposing these identities may facilitate targeted phishing efforts or privilege escalation attempts if weak passwords are employed. The absence of throttling exacerbates this risk, allowing for rapid enumeration at scale without triggering standard security alerts related to excessive authentication failures.
To mitigate this vulnerability, organizations running Kimai versions earlier than 2.54.0 must upgrade immediately to the patched version where the TokenAuthenticator has been corrected to perform constant-time checks or dummy hashing operations even for non-existent users. This ensures that response times remain consistent regardless of username validity, thereby eliminating the timing side-channel. Additionally, administrators should implement robust rate-limiting policies on all authentication endpoints, including those utilizing token-based headers like X-AUTH-USER, to add a layer of defense-in-depth against automated enumeration tools. Monitoring logs for unusual patterns in request frequency and response times can also aid in detecting ongoing exploitation attempts while patch deployment is underway.