CyberRota Analysis
AI-GeneratedKimai versions prior to 2.54.0 are vulnerable to a timing oracle flaw in the TokenAuthenticator, which allows unauthenticated attackers to enumerate valid usernames through the X-AUTH-USER header. The vulnerability arises from measurable response time differences when the password hasher processes existing usernames, facilitating enumeration without any login throttling protections. Organizations using affected versions should prioritize remediation to mitigate the risk of unauthorized access and potential account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.