Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: kimai 2.53.0 Clear all filters
TI-2026-55442 CVE-2026-80201 · GHSA-hqh5-vhwr-rg24

Kimai before 2.53.0 API Token Leakage via Invoice Template

Priority MEDIUM 44

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods.

CVSS 4.0LOW 2.0 Network High privileges User interaction EPSS 0.00227 Published 2026-08-25 Fixed in 2.53.0 CWE-94
TI-2026-55441 CVE-2026-80200 · GHSA-wv9h-9jv8-rqm9

Kimai before 2.53.0 Open Redirect via RelayState

Priority LOW 30

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0036 Published 2026-08-25 Fixed in 2.53.0 CWE-601