CVE-2026-80196Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their password.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-80196

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters46d
Patch
CVE-2026-80196 - Authentication Bypass in Kimai before 2.58.0 via password reset link reuse. CVSS 7.5. Update to version 2.58.0 immediately. #CVE #Kimai #infosec https://www.valtersit.com/cve/CVE-2026-80196 #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker
Post summary
The advisory highlights an authentication bypass in Kimai versions prior to 2.58.0 caused by reused password‑reset links, recommends upgrading to v2.58.0, and provides the CVSS score.
0000043
1.0K followersView on X

Explore more

Back to dashboard