CyberRota Analysis
AI-GeneratedThe Kimai time tracking application is vulnerable to bypassing two-factor authentication (2FA) for API access, allowing authenticated users to perform REST API operations without completing the TOTP verification. This flaw arises from the improper handling of the KIMAI_SESSION cookie, which is accepted by all API routes prior to 2FA completion. Organizations using Kimai versions prior to 2.59.0 should prioritize this vulnerability to mitigate the risk of unauthorized API access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICATED and App\API\Authentication\ApiRequestMatcher routes an existing session through the main firewall. A Scheb TwoFactorToken satisfies that access rule, and App\Voter\ApiVoter grants API access to its User, allowing an attacker with a valid account password to use authenticated REST API operations without entering the second factor even though web routes remain blocked. This issue is fixed in version 2.59.0.