CVE-2026-80196CWE-640

CVE-2026-80196

High · published August 26, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00476 · 40.2th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-08-26T09:18Z
References (3)
https://github.com/kimai/kimai/security/advisories/GHSA-m492-gv72-xvxj · [email protected]https://www.vulncheck.com/advisories/kimai-before-2.58.0-authentication-bypass-via-password-reset-link · [email protected]https://github.com/kimai/kimai/security/advisories/GHSA-m492-gv72-xvxj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:47Z
    EPSS moved — → 0%
    epss
  • 25 AUG 23:19Z
    Kimai before 2.58.0 Authentication Bypass via Password Reset Link
    cvelistv5