Threats tagged 'ghsa-jr9p-4h4j-6c58'

The official Kimai Docker image shipped with a default APP_SECRET environment variable set to a known static value. This default secret was not overridden or validated at startup, allowing attackers to forge HMAC-signed cookies and login links. This enables unauthenticated attackers to take over any account, including super_admin, if they know the username and can guess the user ID, provided the account does not have active two-factor authentication. The issue affects Kimai versions prior to 2.58.0. The vendor has updated the entrypoint script to generate a random APP_SECRET at startup, removed the default static secret from the Dockerfile, and improved login link entropy to mitigate the risk.