Information Exposure Through Timing Discrepancy in kimai2 - CVE-2026-80199
Published: April 20, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU126577
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80199
CWE-ID: CWE-208
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose valid usernames via a timing side channel.
The vulnerability exists due to observable timing discrepancy in src/API/Authentication/TokenAuthenticator.php when handling requests with the legacy X-AUTH-USER and X-AUTH-TOKEN headers. A remote attacker can send specially crafted authentication requests and measure response times to disclose valid usernames via a timing side channel.
The response body and HTTP status are identical for valid and invalid usernames, and no prior authentication, API token, or session cookie is required.
Affected software
kimai2
How to mitigate CVE-2026-80199
Install security update from vendor's website.
kimai2 - update to 2.54.0