CVE-2026-80199 in Kimai
Sumário
de MITRE • 26/08/2026
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.