Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-80196Kimai before 2.58.0 Authentication Bypass via Password Reset Link

High 7.5

In plain English

A high-severity security flaw in kimai from kimai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	kimai/kimai	2.58.0	GHSA-m492-gv72-xvxj

Affected products (as reported)

Vendor	Product	Versions
kimai	kimai	0 – before 2.58.0

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-m492-gv72-xvxj) vendor-advisory
VulnCheck Advisory: Kimai before 2.58.0 Authentication Bypass via Password Reset Link third-party-advisory