CVE-2026-80199: Kimai

Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

Affected products

• Kimai Kimai: before 2.54.0 (fixed in 2.54.0)

Published 2026-08-26. Last modified 2026-10-08.