The Kimai Docker image set APP_SECRET to a default static value 'change_this_to_something_unique' which is used as the Symfony kernel.secret for HMAC signing of authentication cookies, login links, password reset URLs, and CSRF tokens. Because the Docker entrypoint did not override or validate this secret, any deployment using the default secret allowed unauthenticated attackers to forge authentication tokens and login links. User IDs are sequential and visible, enabling attackers to guess valid user IDs and impersonate any user without 2FA. The vulnerability affects all Kimai versions prior to 2.58.0. The vendor fixed this by removing the default secret, generating a random APP_SECRET at container startup, and increasing login link entropy.

An unauthenticated attacker can forge authentication cookies and login links to fully compromise any user account, including super_admin, on Kimai instances deployed with the official Docker image without a custom APP_SECRET. This allows complete account takeover and bypass of authentication protections if two-factor authentication is not enabled. The vulnerability exposes all affected versions prior to 2.58.0 to remote compromise via the internet.

The vendor has released an updated Docker image and entrypoint script that generates a random APP_SECRET at startup and removes the default static secret. Users should upgrade to Kimai version 2.58.0 or later and ensure the APP_SECRET environment variable is set to a unique, random value. The updated entrypoint script automatically manages this secret. Additionally, enabling two-factor authentication on accounts mitigates the risk of takeover. Check the vendor advisory at https://www.kimai.org/en/security/ghsa-jr9p-4h4j-6c58 for the latest remediation details.