Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-52824 – Authentication Bypass / Account Takeover – Kimai Docker image ≤ 2.57.0

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-52824 is a critical authentication bypass vulnerability affecting the official Kimai Docker image, caused by a hardcoded, publicly-known default value for the APP_SECRET environment variable. Because this value is used as Symfony’s kernel.secret to sign authentication-related tokens, an unauthenticated remote attacker can forge valid session artifacts and take over any account, including administrators. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical).

Technical details

  • Root cause: The Kimai Docker image’s Dockerfile hardcodes APP_SECRET=change_this_to_something_unique as a default environment variable, and the container’s entrypoint script does not validate, reject, or override this sentinel value before it is used.
  • Mechanism: This shared, public value becomes Symfony’s kernel.secret, which is used to HMAC-sign remember-me cookies, login links, password-reset URLs, and CSRF tokens.
  • Trigger conditions: Any Kimai instance deployed from the official Docker image without an operator explicitly overriding APP_SECRET at runtime is affected. Exploitation requires the attacker to know or discover a valid username (target accounts, including super_admin, are commonly assigned sequential user IDs starting from 1) and the target account must not have two-factor authentication enabled.
  • Attack vector: Network — no authentication or user interaction is required. Using the known default secret, an attacker can compute a valid HMAC and forge a login-link URL or remember-me cookie to authenticate as any user without knowing their password.
  • Impact: Full unauthenticated account takeover, including of administrative accounts, leading to complete compromise of confidentiality and integrity of the application.

Affected software

  • Kimai (official Docker image) versions up to and including 2.57.0
  • Bare-metal/non-Docker deployments using the shipped .env.dist default value are similarly exposed if the default is not overridden

Severity

  • CVSS v3.1 Base Score: 9.1 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Mitigation and recommended actions

  • Immediate: Upgrade to Kimai 2.58.0 or later, which generates and persists a strong, random APP_SECRET automatically (via bin2hex(random_bytes(32))) and removes the hardcoded default from the Dockerfile.
  • If unable to patch immediately: Explicitly set a unique, strong APP_SECRET value in the deployment’s environment configuration (e.g., .env.local or the Docker environment variables) rather than relying on the shipped default. Enforce two-factor authentication on all accounts, particularly administrative accounts, as an additional compensating control until upgraded.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge