Summary
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
The official Kimai Docker image ships with APP_SECRET=change_this_to_something_unique as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting APP_SECRET runs with a publicly-known Symfony kernel.secret, enabling an unauthenticated attacker to forge HMAC-signed cookies and login links to take over any account including super_admin.
Details
Dockerfile:263 sets ENV APP_SECRET=change_this_to_something_unique. This value is consumed by config/packages/framework.yaml:7 as kernel.secret, which Symfony uses to HMAC-sign:
- The
KIMAI_REMEMBERremember-me cookie - LoginLink signatures
- Password reset URLs
- CSRF tokens
The .docker/entrypoint.sh does not check for or replace the default sentinel value. The bare-metal .env.dist:38 ships the same default. No startup-time guard exists anywhere in the codebase that refuses to start when APP_SECRET equals the sentinel.
User IDs are sequential integers starting from 1. The first super_admin account is almost always id=1. User IDs are visible in some URLs and API responses.
A PoC was provided, but removed for security reasons.
Impact
Any Kimai instance deployed via the official Docker image without overriding APP_SECRET can be compromised from the internet. An unauthenticated attacker who can reach the Kimai URL can forge authentication tokens and log in as any user if:
- a username is known AND
- the correct account ID for this username is guessed AND
- the account has no active 2FA (two factor) authentication
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- The entrypoint.sh file is updated and now contains a script that generates a random
APP_SECRETviabin2hex(random_bytes(32))which will be stored in/opt/kimai/var/data/.appsecret - The entrypoint.sh will create the file
/opt/kimai/.env.localcontaining theAPP_SECRET, either fetched from the Docker Environment or from the newly created secret file - The documentation was updated to highlight the importance of using a random secret for
APP_SECRET - The Dockerfile removed default
APP_SECRET=change_this_to_something_unique - Login links now contain more entropy (see GHSA-m492-gv72-xvxj) - so even without all previous changes, attackers won't be able to generate Login links even for installations that have a hard-coded
APP_SECRET=change_this_to_something_unique
See https://www.kimai.org/en/security/ghsa-jr9p-4h4j-6c58 for more information.
Frequently Asked Questions
- What is CVE-2026-52824? CVE-2026-52824 is a critical-severity security vulnerability in kimai/kimai (composer), affecting versions <= 2.57.0. It is fixed in 2.58.0.
- Which versions of kimai/kimai are affected by CVE-2026-52824? kimai/kimai (composer) versions <= 2.57.0 is affected.
- Is there a fix for CVE-2026-52824? Yes. CVE-2026-52824 is fixed in 2.58.0. Upgrade to this version or later.
- Is CVE-2026-52824 exploitable, and should I be worried? Whether CVE-2026-52824 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-52824 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-52824? Upgrade
kimai/kimaito 2.58.0 or later.