In Kimai versions before 2.59.0, the REST API firewall accepts the KIMAI_SESSION cookie issued immediately after password verification, before the TOTP 2FA step is completed, as fully authenticated. This allows bypassing 2FA for API access by replaying the session cookie obtained after login but before 2FA. The root cause is that the API firewall uses the IS_AUTHENTICATED role, which is granted before 2FA completion, and the API voter does not check if 2FA is in progress. The fix changes the API firewall to require IS_AUTHENTICATED_REMEMBERED, assigned only after 2FA, and updates the API voter to deny access during the 2FA step.

Two-factor authentication protection is completely bypassed for the REST API. An attacker who obtains a user's password can gain full authenticated API access without needing the second factor. This undermines the security benefits of 2FA for API endpoints. No additional tokens or CSRF tokens are required; only the session cookie from the login response is needed. This increases the risk of account compromise via phishing, credential stuffing, or password reuse attacks.

A fix is available in Kimai version 2.59.0 and later. The API firewall now requires IS_AUTHENTICATED_REMEMBERED, which is only granted after successful 2FA completion. The API authorization logic has been updated to deny access if the user is currently in the 2FA step. Users and administrators should upgrade to version 2.59.0 or later to remediate this vulnerability. No additional mitigations are required once patched.