CVE-2026-52824: Kimai Docker Image Hardcoded APP_SECRET Enables Account Takeover

CVE-2026-52824 (TL-2026-1556), also tracked as Kimai Hardcoded APP_SECRET, is a high-severity software vulnerability scored CVSS 7.4, first published 2026-07-20. It has no confirmed attribution, affects Kimai Kimai (Docker image, kimai/kimai), references 1 CVE (CVE-2026-52824), maps to 11 MITRE ATT&CK techniques (T1078, T1087, T1190), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1556

Threat ID
TL-2026-1556
Also known as
Kimai Hardcoded APP_SECRET, Kimai Docker Default Secret Account Takeover
Severity
HIGH
CVSS
7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-20
Last reviewed
2026-07-20
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all sectors running self-hosted kimai time-tracking, professional services, consulting, software development, it services
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in CVE-2026-52824

Malware and tooling: Symfony LoginLink component

The official Kimai Docker image shipped with a hardcoded default APP_SECRET ("change_this_to_something_unique") that the container entrypoint never validated or replaced. Because APP_SECRET is used as Symfony's kernel.secret to HMAC-sign remember-me cookies, login-link signatures, password-reset URLs, and CSRF tokens, any unauthenticated network attacker who knows a target's username and sequential user ID can forge valid authentication material and take over accounts, including super_admin, on any Docker deployment running the unmodified default.

How CVE-2026-52824 works

CVE-2026-52824 is an insecure-default (CWE-1188) vulnerability in the official kimai/kimai Docker image. Kimai is a PHP/Symfony open-source time-tracking application. The Docker image's Dockerfile and entrypoint.sh set APP_SECRET to the literal placeholder string "change_this_to_something_unique" and, prior to the fix, never enforced that operators override it before the application became reachable. APP_SECRET backs Symfony's kernel.secret, which is the cryptographic key used to sign and verify several security-critical, HMAC-protected tokens throughout the application: the KIMAI_REMEMBER remember-me cookie, LoginLink signed URLs (used for password reset and one-time login links), and CSRF tokens.

Because the default value is publicly documented in Kimai's own Docker Hub instructions, changelogs, and countless public docker-compose.yml examples, it functions as a de facto master key shared across every Kimai Docker deployment that was never explicitly reconfigured. An unauthenticated attacker who reaches a vulnerable instance over the network and knows (or discovers, e.g. via the related username-enumeration timing side channel GHSA-jrc6-fmhw-fpq2) a target's username and numeric user ID can independently compute valid HMAC signatures for that user's remember-me cookie or LoginLink, granting a fully authenticated session without ever supplying a password. Because Kimai assigns user IDs as small sequential integers, the platform's own super_admin account is trivially guessable, making full administrative takeover the realistic worst case. A companion advisory, GHSA-m492-gv72-xvxj (CWE-640, Weak Password Recovery Mechanism), compounds the impact: the LoginLink/password-reset signature historically covered only the user ID and not the current password hash, so a forged reset link remains valid even after the victim changes their password, and low signature entropy made the links themselves easier to guess independent of secret exposure.

The vulnerability was reported by security researcher AzureADTrent and coordinated with Kimai maintainer Kevin Papst. A working proof-of-concept demonstrating cookie/LoginLink forgery was initially published alongside the advisory and later withdrawn by the researcher to limit misuse, which the vendor and downstream reporting both treat as confirmation of practical exploitability rather than a theoretical weakness. The fix, shipped in Kimai 2.58.0, rewrites the Docker entrypoint to remove the hardcoded default entirely: if no APP_SECRET is supplied, the entrypoint now generates a cryptographically random 32-byte secret via bin2hex(random_bytes(32)), persists it to /opt/kimai/var/data/.appsecret so it survives container restarts, and writes it into /opt/kimai/.env.local. The fix also increases LoginLink signature entropy per GHSA-m492-gv72-xvxj. Any pre-2.58.0 Docker deployment that never set a custom APP_SECRET remains fully exploitable until upgraded or reconfigured, and instances that were exposed while vulnerable should be treated as potentially compromised: secrets must be rotated, all active sessions invalidated, and administrator account activity audited, since simply upgrading does not retroactively invalidate tokens forged with the old, known secret.

MITRE ATT&CK techniques used in TL-2026-1556

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

Discovery

T1087 Account Discovery

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1606 Forge Web Credentials

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-52824

  • Kimai — Kimai (Docker image, kimai/kimai)
    Vulnerable versions: <= 2.57.0; all versions using the official Docker image without a custom APP_SECRET
    Fixed in: 2.58.0

Remediation for CVE-2026-52824

Patches

  • Kimai 2.58.0 — entrypoint.sh no longer ships a hardcoded APP_SECRET default; generates and persists a random 32-byte secret via bin2hex(random_bytes(32)) when none is supplied

Immediate actions

  • Upgrade all Kimai Docker deployments to version 2.58.0 or later
  • If upgrading is not immediately possible, explicitly set a unique, high-entropy APP_SECRET environment variable rather than relying on the image default
  • Treat any instance that ran with the default APP_SECRET as potentially compromised: rotate the secret and invalidate all active sessions
  • Force-expire and reissue all KIMAI_REMEMBER cookies, LoginLink tokens, and CSRF tokens after secret rotation
  • Audit administrator (super_admin) account activity and password-reset history for signs of unauthorized access

Workarounds

  • Manually set a unique, randomly generated APP_SECRET environment variable in the container/deployment configuration before exposing the instance to any network

Longer-term hardening

  • Enable two-factor authentication for all privileged (super_admin) accounts, since 2FA blocks token-forgery-based takeover even if APP_SECRET is exposed
  • Restrict network exposure of Kimai instances that do not need to be internet-facing
  • Adopt secrets-management tooling (e.g. Docker secrets, a vault) instead of plaintext environment variables for APP_SECRET
  • Periodically audit self-hosted container images for hardcoded default credentials or secrets before production deployment
  • Apply the related GHSA-m492-gv72-xvxj and GHSA-jrc6-fmhw-fpq2 fixes to close the password-reset-validity and username-enumeration issues that compound this flaw

CVEs associated with CVE-2026-52824

CVE-2026-52824

Weaknesses (CWE) in CVE-2026-52824

CWE-1188, CWE-640, CWE-208

Timeline of CVE-2026-52824

  • Vulnerability privately disclosed to and acknowledged by Kimai maintainer Kevin Papst for coordinated remediation.
  • Security researcher AzureADTrent discovers and reports the hardcoded Kimai Docker image APP_SECRET issue to maintainer Kevin Papst.
  • Companion advisories GHSA-m492-gv72-xvxj (password-reset link remains valid after password change) and GHSA-jrc6-fmhw-fpq2 (username enumeration via X-AUTH-USER timing side channel) are published alongside CVE-2026-52824, documenting flaws that compound its exploitability by supplying the username precondition and extending forged-link validity.
  • GitHub Security Advisory GHSA-jr9p-4h4j-6c58 is published by the kimai/kimai repository, formally documenting the flaw and fix.
  • Kimai 2.58.0 ships, removing the hardcoded APP_SECRET default and adding random secret generation (bin2hex(random_bytes(32))) with persistent storage.
  • GitLab Advisory Database publishes the formal CVE-2026-52824 record with CVSS 3.1 vector and affected/fixed version ranges.
  • GBHackers publishes an independent technical analysis of the vulnerability, corroborating exploitation mechanics and remediation guidance.
  • Cyber Security News publishes the first mainstream write-up of CVE-2026-52824, noting a proof-of-concept was released and later withdrawn to limit misuse.

Sources cited for CVE-2026-52824

Threats related to CVE-2026-52824

Detection coverage for TL-2026-1556

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1556 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats