CVE-2026-80200 in Kimai
Summary
by MITRE • 08/26/2026
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The identified vulnerability resides within the Kimai time-tracking and billing software, specifically affecting versions prior to 2.53.0. It is classified as an open redirect flaw located in the SAML authentication success handler component of the application. This security issue stems from a fundamental failure in input validation, where the system accepts RelayState POST parameters provided by the Identity Provider without performing adequate checks on their destination URLs. In standard Security Assertion Markup Language implementations, the RelayState parameter is designed to preserve state information between the service provider and identity provider during authentication flows. However, Kimai incorrectly utilizes this parameter as a direct redirect target after successful authentication, bypassing necessary validation logic that should ensure the URL points only to trusted internal resources or explicitly whitelisted external domains.
From an operational perspective, this vulnerability allows attackers who have access to a compromised Identity Provider or can manipulate SAML assertions to execute phishing campaigns against Kimai users. By supplying malicious RelayState values, an attacker can redirect authenticated users to externally controlled websites that mimic legitimate login pages or financial portals. This mechanism facilitates credential theft and social engineering attacks with high credibility because the user has already passed through the application's authentication process, creating a false sense of security. The attack vector leverages the trust relationship between the service provider and identity provider, exploiting the fact that users typically do not scrutinize URLs in browser address bars immediately after logging into trusted applications.
This vulnerability aligns with Common Weakness Enumeration category CWE-601, which defines URL redirection to untrusted site as a distinct weakness involving insufficient validation of redirect destinations. Furthermore, it maps directly to MITRE ATT&CK technique T1588.002, specifically Obfuscated Redirects under the Initial Access tactics. The exploitation relies on manipulating standard protocol parameters to bypass security controls and deceive end-users into interacting with malicious infrastructure. The impact extends beyond simple redirection; it compromises user confidentiality by enabling credential harvesting and can lead to broader account compromise if users enter sensitive information on the phishing site.
Mitigation strategies primarily involve upgrading Kimai to version 2.53.0 or later, where this validation logic has been corrected to restrict redirect destinations to safe origins. For organizations unable to immediately patch their systems, implementing a reverse proxy configuration that validates and sanitizes RelayState parameters before they reach the application backend can provide temporary protection. Additionally, enforcing strict Content Security Policy headers and educating users about verifying post-authentication URLs can reduce the success rate of such phishing attempts. Regular audits of SAML integration configurations are recommended to ensure no other endpoints in the authentication flow suffer from similar validation deficiencies.