Kimai Docker Image Vulnerable to Account Takeover via Insecure Default Secret
A critical vulnerability in the official Kimai Docker image allows unauthenticated attackers to forge authentication cookies and take over user accounts, including administrators.
A critical vulnerability, identified as CVE-2026-53412, has been discovered in the official Docker image for the open-source time-tracking application Kimai. This flaw affects versions prior to 2.58.0 and enables unauthenticated attackers to forge authentication cookies, potentially leading to complete account takeover. The vulnerability stems from an insecure default value for the APP_SECRET environment variable, which is crucial for securing various application functions.
The core of the issue lies in the Docker image's default configuration, which shipped with the publicly known secret change_this_to_something_unique. This value was intended to be replaced by users during deployment, but the Docker startup process did not enforce this change or automatically generate a unique secret. Kimai utilizes this APP_SECRET as Symfony’s kernel secret, a cryptographic key used to sign and validate security tokens, including remember-me cookies, login link signatures, password reset URLs, and CSRF tokens.
With the default APP_SECRET in place, an attacker with network access to a vulnerable Kimai instance can exploit this known cryptographic key to craft malicious tokens. By forging these tokens, an attacker can impersonate any user without needing valid credentials. The severity of the exploit is amplified by the predictable nature of Kimai user IDs, which are sequential integers starting from 111. This makes it relatively easy for attackers to target specific users, especially the first super administrator account, which is commonly assigned ID 111.
While two-factor authentication (2FA) can serve as a mitigating control for targeted accounts, the advisory warns that accounts without active 2FA are fully vulnerable to compromise. The remote nature of this attack against exposed applications makes it an urgent concern for organizations using Kimai with default Docker settings. The vulnerability has been classified as critical and is categorized under CWE-1188, "Initialization of a Resource with an Insecure Default."
Security researcher AzureADTrent is credited with discovering and reporting the vulnerability. Initially, a proof of concept was released but later removed to mitigate the risk of widespread exploitation. The vulnerability has since been addressed in Kimai version 2.58.0.
Kimai version 2.58.0 rectifies this security lapse by modifying the Docker initialization process. The updated entrypoint now automatically generates a random APP_SECRET using bin2hex(random_bytes(32)) if an administrator has not provided a custom secret. This newly generated secret is stored in /opt/kimai/var/data/.appsecret, and the deployment configuration is updated in /opt/kimai/.env.local.
In addition to the automated secret generation, the Kimai maintainers have removed the hard-coded default secret from the Dockerfile and updated their documentation to emphasize the importance of using unique, randomly generated secrets. Furthermore, a separate advisory addresses strengthened login-link entropy to reduce risks associated with predictable secrets in older configurations. Users are strongly advised to upgrade to Kimai version 2.58.0 or later immediately.
Beyond upgrading, administrators should proactively set a high-entropy, unique APP_SECRET, rotate credentials and active sessions where possible, review all administrator accounts for suspicious activity, and enforce the use of two-factor authentication for all privileged users to bolster their security posture against such attacks.