Kimai users who are running the official Docker image are strongly urged to update their installations after a critical vulnerability, tracked as CVE-2026-52824 and GHSA-jr9p-4h4j-6c58, was discovered.
This vulnerability exposes installations to the risk of account takeover due to a publicly known application secret. The flaw affects Kimai versions 2.57.0 and earlier, and it has been fixed in version 2.58.0.
Reported by security researcher AzureADTrent and published by Kimai maintainer Kevin Papst on June 11, the issue arises from an insecure default configuration in the official container image.
Kimai Docker Vulnerability
The default environment variable, defined as `APP_SECRET=change_this_to_something_unique`, is intended to be replaced during deployment.
This value serves as the application’s `kernel.secret` in Symfony, a cryptographic key used to generate and validate HMAC-protected security artifacts. However, Kimai’s Docker entrypoint did not validate, replace, or refuse to start with this insecure default, leading to potential vulnerabilities.
As a result, Kimai deployments that are accessible over the internet and launched with the default Docker configuration may expose a predictable cryptographic secret.
An unauthenticated attacker could exploit this known value to forge security-sensitive data and potentially authenticate as another user, including a super_admin account.
To successfully exploit this vulnerability, the attacker must know the target username, determine or guess its account ID, and target an account that does not have active two-factor authentication enabled.
Symfony relies on this affected secret for signing several sensitive components, including the KIMAI_REMEMBER remember-me cookie, LoginLink signatures, password-reset URLs, and CSRF tokens.
Since Kimai user IDs are sequential integers starting from 11, the first administrative account is often assigned ID 11. Additionally, user IDs may be exposed in URLs or API responses, making it easier for attackers to target privileged accounts.
This issue is classified as critical and is mapped to CWE-1188, “Initialization of a Resource with an Insecure Default.” The vulnerability highlights a common problem in container security: shipping predictable secrets in production-ready images while failing to enforce secret rotation or secure initialization at startup.
In response, Kimai version 2.58.0 changes the Docker initialization process to automatically generate a random `APP_SECRET` using `bin2hex(random_bytes(32))` when none is provided via the environment. The generated secret is stored in `/opt/kimai/var/data/.appsecret`.
At the same time, the entrypoint creates `/opt/kimai/.env.local` containing either the administrator-provided value or the newly generated secret. The project has removed the insecure `APP_SECRET` value from the Dockerfile and updated its documentation to emphasize the need for a random, deployment-specific secret.
Additionally, Kimai has increased entropy in LoginLink values in a related advisory (GHSA-m492-gv72-xvxj). This change prevents attackers from generating LoginLinks simply because an older deployment uses the hard-coded default secret. However, administrators should not treat this change as a substitute for patching.
Organizations should immediately upgrade their Kimai Docker deployments to version 2.58.0 or later, explicitly set a strong, unique `APP_SECRET`, and rotate the secret on any potentially compromised instances.
Administrators should also invalidate active sessions wherever possible, review administrator accounts and authentication activity, enable two-factor authentication, and restrict public access to Kimai instances that do not require internet exposure.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
