Threats Tagged 'cve-2026-52824'
View all threats tagged with 'cve-2026-52824'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-52824'
Click on any threat for detailed analysis and mitigation recommendations
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (CVE-2026-52824)CVE-2026-52824 0 The official Kimai Docker image shipped with a default APP_SECRET environment variable set to a known static value. This default secret was not overridden or validated at startup, allowing attackers to forge HMAC-signed cookies and login links. This enables unauthenticated attackers to take over any account, including super_admin, if they know the username and can guess the user ID, provided the account does not have active two-factor authentication. The issue affects Kimai versions prior to 2.58.0. The vendor has updated the entrypoint script to generate a random APP_SECRET at startup, removed the default static secret from the Dockerfile, and improved login link entropy to mitigate the risk. Join the discussion | GCVE Database | 07/14/2026, 00:07:59 UTC Added: 07/14/2026, 09:21:12 UTC |
Showing 1 to 1 of 1 result