Kimai EUVD-2026-66218

Exploitation requires two conditions: the targeted Kimai instance must be running a version prior to 2.58.0, and the attacker must obtain the original password reset link through a secondary channel - specifically via email relay or security scanner pre-clicking (Microsoft Defender ATP, Mimecast, Barracuda), proxy or WAF log access, shared inbox access, browser history synchronization across devices, or HTTP Referer header leakage. No authentication to Kimai is required; the intercepted link itself serves as the authentication credential. Exploitation is time-bounded to a 1-hour window from link generation and capped at 3 total uses across all parties. Admin-generated links via the kimai:user:login-link console command share the same vulnerable signature scheme, representing a second attack surface beyond standard user-initiated resets.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects that no authentication or special configuration is required to exploit an intercepted link - the link itself is the credential. Real-world risk is bounded by the 1-hour validity window and 3 maximum total uses, and exploitation requires secondary access to the reset link through email relay interception, proxy logs, browser history sync, or shared inboxes. No EPSS data was provided, preventing probabilistic exploitation rate assessment. No CISA KEV listing is present at time of analysis, and the absence of KEV should not lower urgency given the fully documented PoC. The corporate threat model is particularly acute: mail-relay security scanners (Microsoft Defender ATP, Mimecast, Barracuda) routinely pre-click URLs in emails, meaning link interception can occur automatically without an active adversary. Organizations running Kimai for employee time-tracking should treat the PoC availability and realistic interception vectors as sufficient grounds for urgent patching regardless of raw CVSS score.

An attacker with access to a corporate email gateway, proxy log, or mail-relay scanner output captures a Kimai password reset URL after a user initiates account recovery. The user completes the reset and changes their password, believing the account is now secured. Within the 1-hour validity window, the attacker opens the same URL in a private browser session and obtains a fully authenticated Kimai session as the victim - a step-by-step PoC for this exact scenario is published in the GHSA advisory.