Kimai EUVD-2026-66221

The attack requires network access to the Kimai API (/api/* endpoints) and the presence of Kimai 2.x with legacy X-AUTH-USER / X-AUTH-TOKEN header authentication enabled - which is the default configuration in the 2.x series. No authentication, API token, or session cookie is required. The attack is limited by: (1) AC:H - timing reliability degrades under high network jitter or server load, requiring statistical sampling to achieve confidence; (2) the absence of login throttling is a prerequisite for unbounded probing - instances behind a WAF or reverse proxy that enforces rate limits will have their timing signal corrupted or blocked; (3) impact is strictly limited to username enumeration, with no direct path to authentication bypass or data access from this vulnerability alone.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L) correctly characterizes this as a network-reachable, no-privilege-required flaw with low confidentiality impact - the score of 6.3 is appropriate. AC:H and AT:P reflect the real-world complexity of reliable timing measurement: network jitter and server load variation require statistical sampling (the PoC uses 15 probes per candidate and a configurable threshold), meaning the attack is slower and noisier than typical enumeration bugs but well within reach of a patient attacker. There is no EPSS score available in the provided data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. However, the publicly available PoC materially lowers the barrier. The primary real-world risk is that successful username enumeration feeds targeted password-spray or credential-stuffing campaigns against Kimai instances, which may store sensitive time-tracking and client billing data. Impact is bounded to information disclosure (no integrity or availability consequence), but the absence of throttling is a compounding factor on instances facing the internet.

An unauthenticated attacker with network access to a Kimai instance sends repeated requests to /api/users/me with candidate usernames in the X-AUTH-USER header and a dummy X-AUTH-TOKEN, measuring median response latency across 15 or more probes per candidate. Usernames that consistently return responses ~25ms slower than a known-invalid baseline are flagged as valid accounts. The attacker then uses the harvested username list to launch targeted password-spray attacks against the Kimai login endpoint; a working Python PoC automating this entire flow is included in the GitHub Security Advisory.