CVE-2026-80196: Kimai before 2.58.0 Authentication Bypass via Password Reset Link
Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
The attacker must intercept or otherwise possess a valid password reset link for the target user. No authentication or user interaction is required to use the captured link.
How long and how often can a captured link be used after the password is changed?
A captured reset link can remain usable for up to one hour after issuance, even if the legitimate user changes their password. It can be used to log in as that user up to two additional times.
Which deployments are affected?
Kimai versions before 2.58.0 are affected. The issue concerns password-reset links generated by the application.