What is CVE-2026-80199?

CVE-2026-80199 is a low-severity vulnerability in Kimai, classified under CWE-208. CVSS score: 3.7/10. Published 2026-08-25.

How severe is CVE-2026-80199?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Kimai

CVE-2026-80199

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Kimai

Weakness classification (CWE)

CWE-208

References

GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2) (vendor-advisory)
VulnCheck Advisory: Kimai before 2.54.0 Username Enumeration via Timing Oracle (third-party-advisory)

Frequently asked questions

What is CVE-2026-80199?: CVE-2026-80199 is a low-severity vulnerability in Kimai, classified under CWE-208. CVSS score: 3.7/10. Published 2026-08-25.
How severe is CVE-2026-80199?: Low severity. CVSS v3 base score is 3.7 out of 10.