Packagist/kimai/kimai CVE-2026-52827: high 7.1, EPSS 0.58%

Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

Action: Upgrade kimai/kimai to 2.59.0 or later.

composer require kimai/kimai:2.59.0

Affected

Fixed versions

Sources

• osv: GHSA-v8hx-4vx8-wc96
• nvd: CVE-2026-52827
• https://github.com/kimai/kimai/security/advisories/GHSA-v8hx-4vx8-wc96
• https://github.com/kimai/kimai

CVE-2026-52827 · published 2026-07-14T00:33:39Z · modified 2026-07-14T00:56:42.847582Z · JSON