CVE-2026-80200 kimai CVE debrief

Who should care

Administrators and users of Kimai versions before 2.53.0, as well as security teams monitoring for potential phishing attacks, should be aware of the vulnerability and take necessary precautions to protect their systems. This includes verifying the Kimai version, restricting access to SAML authentication, and monitoring for suspicious redirect activity. Additionally, security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified, and relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Affected operator, platform, vulnerability-management, and security-team impact should be considered when assessing the vulnerability's impact. The SAML authentication success handler's acceptance of unvalidated RelayState POST parameters as redirect destinations allows attackers with IdP access to supply malicious RelayState values, redirecting authenticated users to attacker-controlled URLs for credential theft or phishing attacks. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. The vulnerability's CVSS score of 5.3 and severity of MEDIUM indicate a moderate level of risk. Limited information is available on the scope of affected deployments and potential attack vectors, making it essential to verify Kimai version and restrict access to SAML authentication. The open redirect vulnerability in Kimai before 2.53.0 allows attackers with IdP access to redirect authenticated users to attacker-controlled URLs, potentially leading to credential theft or phishing attacks. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. The vulnerability's impact on affected operator, platform, vulnerability-management, and security-team should be assessed,

Technical summary

CVE-2026-80200 is an open redirect vulnerability in Kimai before 2.53.0. The vulnerability exists in the SAML authentication success handler, which accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Limited information is available on the scope of affected deployments and potential attack vectors.

Defensive priority

Authenticated users of Kimai versions before 2.53.0 may be redirected to attacker-controlled URLs, potentially leading to credential theft or phishing attacks. Verify Kimai version and restrict access to SAML authentication.

Recommended defensive actions

• Verify Kimai version and upgrade to 2.53.0 or later
• Restrict access to SAML authentication
• Monitor for suspicious redirect activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-80200 record indicates an open redirect vulnerability in Kimai before 2.53.0. The vulnerability is in the SAML authentication success handler, which accepts unvalidated RelayState POST parameters as redirect destinations. Limited information is available on the scope of affected deployments and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.