Kimai-CVE-2026-52824-POC

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

CVE-2026-52824 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APPSECRET to the public value changethistosomethingunique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony uses it as kernel.secret. An unauthenticated...

CVE-2026-52824

Kimai is an open-source time tracking application. Prior to version 2.58.0 , the official Docker image hardcodes APP_SECRET=change_this_to_something_unique in the Dockerfile, and the entrypoint script neither replaces nor validates this value before Symfony uses it as kernel.secret. An unauthenti...