CVE-2026-80199: Kimai before 2.54.0 Username Enumeration via Timing Oracle

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-10-08
Weakness: CWE-208

Description

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

Affected products

kimai: before 2.54.0 — fixed in 2.54.0

How to fix

Upgrade to a fixed version: kimai 2.54.0. Check the vendor advisory for mitigations.

References

https://github.com/kimai/kimai/security/advisories/GHSA-jrc6-fmhw-fpq2
https://www.vulncheck.com/advisories/kimai-before-2.54.0-username-enumeration-via-timing-oracle

Get alerted when CVE-2026-80199 or the next vulnerability affects your stack