Threats Tagged 'cve-2026-52827'
View all threats tagged with 'cve-2026-52827'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-52827'
Click on any threat for detailed analysis and mitigation recommendations
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP (CVE-2026-52827)CVE-2026-52827 0 Kimai versions prior to 2.59.0 have a vulnerability where the KIMAI_SESSION cookie issued after password verification but before completing two-factor authentication (2FA) grants full authenticated REST API access, effectively bypassing the TOTP second factor. This allows an attacker who knows the user's password to access the API without the second factor. The issue arises because the API firewall accepts the session cookie as authenticated before 2FA is completed. The vulnerability is fixed by requiring a higher authentication level after 2FA and updating the API authorization checks. Join the discussion | GCVE Database | 07/14/2026, 00:33:39 UTC Added: 07/14/2026, 09:21:03 UTC |
Showing 1 to 1 of 1 result