A critical vulnerability in the official Kimai Docker image has been disclosed, allowing unauthenticated attackers to forge authentication tokens and take over any user account, including super_admin, on affected deployments.
Tracked as CVE-2026-52824, the flaw stems from a hardcoded default secret shipped in Kimai’s containerized deployments.
The official Kimai Docker image sets APP_SECRET=change_this_to_something_unique as a default environment variable in the Dockerfile.
Critical Kimai Docker Flaw
Critically, the Docker entrypoint script never validates or overrides this placeholder value, meaning any operator who deploys Kimai via Docker without manually setting a unique APP_SECRET runs their instance with a publicly known Symfony kernel.secret.
This secret underpins several of Symfony’s HMAC-signing mechanisms, including the KIMAI_REMEMBER remember-me cookie, LoginLink signatures, password reset URLs, and CSRF tokens. Because the secret is public knowledge, an attacker can forge any of these tokens using only the secret.
Kimai assigns sequential integer IDs to user accounts, and the first-created super_admin account almost always holds id=1. Since user IDs are frequently exposed in URLs and API responses, attackers have a reliable path to targeting high-privilege accounts.
Combined with the forgeable APP_SECRET, an attacker only needs a known username, the correct account ID for that username, and the absence of active two-factor authentication on the target account to successfully hijack it.
The issue is classified under CWE-1188, Initialization of a Resource with an Insecure Default, in which a value intended for administrator customization ships with an inherently unsafe default.
Notably, the flaw wasn’t confined to Docker. The bare-metal .env.dist template carried the identical placeholder, and no startup-time check anywhere in the codebase prevented it from launching with the known-bad secret.
Kimai maintainer kevinpapst addressed the issue in version 2.58.0 with several layered mitigations. The entrypoint.sh script now auto-generates a cryptographically random APP_SECRET via bin2hex(random_bytes(32)), persisting it to /opt/kimai/var/data/.appsecret.
This generated or environment-supplied secret is then written to /opt/kimai/.env.local at container startup, and the insecure default has been stripped entirely from the Dockerfile.
Documentation was also updated to emphasize the necessity of setting a unique secret. Additionally, login links received extra entropy under a companion advisory, GHSA-m492-gv72-xvxj, closing the exploitation path even for legacy instances still running the old hardcoded secret.
Organizations running Kimai via Docker should upgrade to version 2.58.0 or later immediately. Administrators unable to patch right away should manually set a unique, high-entropy APP_SECRET and enforce two-factor authentication on all admin accounts as an interim mitigation.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
