CVE-2026-80199

Published: Ago 26, 2026 Last Modified: Ago 26, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

208

Observable Timing Discrepancy

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Access Control
Potential Impacts:
Read Application Data Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/kimai/kimai/security/advisories/GHSA-jrc…
https://github.com/kimai/kimai/security/advisories/GHSA-jrc6-fmhw-fpq2
https://www.vulncheck.com/advisories/kimai-before-2.54.0-us…
https://www.vulncheck.com/advisories/kimai-before-2.54.0-username-enumeration-v…