PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-80199 kimai CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T05:18:27.530Z and has not been modified since then. The Kimai application, prior to version 2.54.0, contains a timing oracle vulnerability in the TokenAuthenticator. This vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring response time differences when the password hasher runs only for existing users. System administrators and security professionals responsible for Kimai installations, particularly those exposed to untrusted networks or users, should be aware of this vulnerability and take appropriate defensive measures. Medium-priority defensive actions are recommended due to potential for username enumeration. Evidence from official CVE and NVD sources indicates a timing oracle vulnerability in Kimai's TokenAuthenticator, allowing unauthenticated attackers to enumerate valid usernames. Defensive measures should focus on limiting exposure and monitoring for suspicious activity.

Vendor
kimai
Product
Unknown
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-26
Original CVE updated
2026-08-31
Advisory published
2026-08-26
Advisory updated
2026-08-31

Who should care

System administrators and security professionals responsible for Kimai installations, particularly those exposed to untrusted networks or users, should be aware of this vulnerability and take appropriate defensive measures.

Technical summary

The Kimai application, prior to version 2.54.0, contains a timing oracle vulnerability in the TokenAuthenticator. This vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring response time differences when the password hasher runs only for existing users. The vulnerability is characterized by the following: CVSS Score: 6.3, CVSS Severity: MEDIUM, CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The CWE associated with this vulnerability is CWE-208.

Defensive priority

Medium-priority defensive actions recommended due to potential for username enumeration.

Recommended defensive actions

  • Implement Web Application Firewall (WAF) rules to detect and prevent suspicious X-AUTH-USER header usage
  • Enforce rate limiting on authentication attempts to slow down enumeration efforts
  • Monitor system logs for unusual response times or patterns indicative of enumeration attempts
  • Consider implementing additional authentication factors to reduce reliance on username/password combinations
  • Upgrade to Kimai version 2.54.0 or later when available

Evidence notes

Evidence from official CVE and NVD sources indicates a timing oracle vulnerability in Kimai's TokenAuthenticator, allowing unauthenticated attackers to enumerate valid usernames. Defensive measures should focus on limiting exposure and monitoring for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-80199 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-80199

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-80199 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-80199

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.