CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
Unauthenticated attackers can enumerate valid usernames in Kimai by measuring response time differences in the authentication process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-80199?
CVE-2026-80199 is a medium-severity vulnerability in kimai, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
Weakness: CWE-208
Which versions are affected by CVE-2026-80199?
2 open source packages ship an affected version, including kimai/kimai.
| Package | Affected | Fixed in |
|---|---|---|
kimai/kimai Packagist | All versions | 2.54.0 |
kimai/kimai Packagist | All versions | 2.54.0 |
How do I fix CVE-2026-80199?
Upgrade kimai/kimai to 2.54.0 or later.
Is CVE-2026-80199 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-80199 exists.
Sources
Also known as GHSA-jrc6-fmhw-fpq2, GHSA-p6f7-72pm-r6j9.