Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.5 · kimaiNVD modified 2026-10-08 16:16
Affected (CPE criteria) 1
cpe:2.3:a:kimai:kimai:1.30.10:*:*:*:*:*:*:*
References 3
- https://github.com/kimai/kimai/releases/tag/1.30.10 Product, Release Notes
- https://www.exploit-db.com/exploits/51278 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking Third Party Advisory