Critical · published December 20, 2025
⚡ A crafty PHP script can snag your session cookies without breaking a sweat! This SameSite cookie vulnerability in Kimai 1.30.10 makes it alarmingly simple for attackers to hijack your sessions. 🔥 Think of it like leaving your car door unlocked at a busy parking lot. A sneaky thief could easily hop in and grab your belongings without you ever noticing! In this case, your session cookies are the valuables at stake, and that script is the thief's quick getaway. If exploited, an attacker could capture your session cookies and impersonate you, accessing all your user data and potentially wreaking havoc on your account. This could lead to unauthorized actions, data breaches, and a major headache for you and your organization!
Think of it like leaving your car door unlocked at a busy parking lot. A sneaky thief could easily hop in and grab your belongings without you ever noticing! In this case, your session cookies are the valuables at stake, and that script is the thief's quick getaway. This vulnerability arises from the SameSite cookie attribute not being enforced correctly, allowing attackers to execute malicious PHP scripts that log session cookie information to a file.
If exploited, an attacker could capture your session cookies and impersonate you, accessing all your user data and potentially wreaking havoc on your account. This could lead to unauthorized actions, data breaches, and a major headache for you and your organization! Act quickly to patch Kimai to version 1.30.11 or later. Review your cookie settings to ensure proper SameSite attributes are implemented, and educate users about not clicking on suspicious links. 🚨 You've got this! Secure your sessions today, and you'll have this vulnerability under control in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| kimai/kimai | all versions | — |