CVE-2023-53957: Kimai

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

Affected products

• Kimai Kimai: version 1.30.10 only

Published 2025-12-19. Last modified 2026-10-08.