Kimai versions prior to 2.59.0 have a vulnerability where the KIMAI_SESSION cookie issued after password verification but before completing two-factor authentication (2FA) grants full authenticated REST API access, effectively bypassing the TOTP second factor. This allows an attacker who knows the user's password to access the API without the second factor. The issue arises because the API firewall accepts the session cookie as authenticated before 2FA is completed. The vulnerability is fixed by requiring a higher authentication level after 2FA and updating the API authorization checks.