CVE-2026-80200: Kimai before 2.53.0 Open Redirect via RelayState
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to the identity provider and must be able to supply a malicious RelayState value during the SAML authentication flow. The attack also requires an authenticated user to follow the resulting redirect.
Are all Kimai deployments affected?
The issue is in the SAML authentication success handler, so exposure depends on use of SAML authentication. Kimai versions before 2.53.0 are affected.
What is the impact of a successful exploit?
The attacker can redirect an authenticated user to an attacker-controlled URL. This can support phishing or credential-theft attempts, but the provided information does not indicate direct confidentiality, integrity, or availability impact to Kimai itself.
What should be done to remediate the issue?
Upgrade Kimai to version 2.53.0 or later. If upgrading is not immediately possible, restrict identity-provider access to trusted administrators and users who cannot submit malicious RelayState values.