CVE-2026-80199 in Kimai
要約
〜によって MITRE • 2026年08月26日
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.