CVE-2026-80199CWE-208

CVE-2026-80199

Low · published August 26, 2026

CVSS v3.1

3.7

EPSS

Percentile

22.5

In the wild

Unconfirmed

What it is

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

The record

Technical detail

CVSS v3.1: 3.7 · LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: 6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00308 · 22.5th percentile
Weakness: CWE-208 · Observable Timing Discrepancy
Published: 2026-08-26T09:18Z

References (2)

https://github.com/kimai/kimai/security/advisories/GHSA-jrc6-fmhw-fpq2 · [email protected]https://www.vulncheck.com/advisories/kimai-before-2.54.0-username-enumeration-via-timing-oracle · [email protected]

EPSS history

Timeline

27 AUG 06:47Z
EPSS moved — → 0%
epss
25 AUG 23:19Z
Kimai before 2.54.0 Username Enumeration via Timing Oracle
cvelistv5