CVE-2026-80199: Kimai before 2.54.0 Username Enumeration via Timing Oracle
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.54.0 - Configuration
Upgrade Kimai to 2.54.0 to remediate the timing oracle in TokenAuthenticator that enables username enumeration via the X-AUTH-USER header.
Kimai TokenAuthenticator X-AUTH-USER header handling = Apply fix in Kimai before 2.54.0 to prevent timing-based username enumeration via X-AUTH-USER
Event History
Frequently Asked Questions
Who can exploit this issue, and what access is required?
Any unauthenticated remote attacker can attempt exploitation by sending requests with the X-AUTH-USER header and measuring response-time differences. No account, privileges, or user interaction are required.
What can an attacker gain from exploiting the timing oracle?
The issue allows enumeration of valid usernames. The provided information does not indicate direct password disclosure, authentication bypass, data modification, or denial-of-service impact.
Why are response times different for valid and invalid usernames?
For existing users, the password hasher runs, creating a measurable timing difference. This behavior occurs in TokenAuthenticator and can reveal whether a supplied username exists.
Does login throttling mitigate this attack?
No. The vulnerability description states that there is no login throttling protection for this enumeration method.
Which versions need remediation?
Kimai versions before 2.54.0 are affected. Updating to version 2.54.0 or later addresses the affected version range described.