GitHub Exploit Metadata - Exploit Intel

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-02

Technical assessment

The artifact is a complete exploit toolkit for CVE-2026-52824, a critical authentication bypass in Kimai. It includes a Python script (exploit.py) that forges a KIMAI_REMEMBER cookie using a hardcoded default APP_SECRET and an empty signature_properties hash, then uses the cookie to authenticate against a target instance and access protected pages.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md, exploit.py, requirements.txt) describe and implement a proof-of-concept exploit for CVE-2026-52824, a known vulnerability in Kimai. The code forges a remember-me cookie using a hardcoded default secret and attempts to access protected pages. No concealed backdoor, credential exfiltration, persistence mechanism, or unrelated payload was observed. The behavior is consistent with the stated exploit purpose.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPythonMarkdown

Target softwareKimai

Attack typesauthentication bypassaccount takeovercookie forgery

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is classified as an exploit because the main Python script (exploit.py) contains code that forges a valid authentication cookie and uses it to gain unauthorized access to a target application, which is the definition of an exploit. The README explicitly describes it as a 'Proof-of-concept exploit toolkit' and details the attack chain from advisory to admin session.

README.md:5README.md:15exploit.py:223-365

Requirements

Target must be a Kimai instance ≤ 2.57.0 using the default APP_SECRET (change_this_to_something_unique) as shipped in Docker or .env.dist.README.md:5exploit.py:8-11
The attacker must know or guess a valid username (e.g., admin, super_admin) and the corresponding user ID is sequential (admin = id:1).README.md:13README.md:42

Observed behavior

The exploit script computes a constant FieldsHash (SHA256 of empty string) and uses the known default APP_SECRET to compute an HMAC-SHA256 signature, then assembles a forged KIMAI_REMEMBER cookie.exploit.py:70-100exploit.py:103-130
The script sets the forged cookie in an HTTP session and attempts to access protected paths (e.g., /en/dashboard, /en/admin/user/) to verify successful authentication bypass.exploit.py:311-365
The README describes the toolkit as containing a single-target exploit, a multi-threaded batch exploitation script, a scanner, version probes, and a Shodan discovery script.README.md:56-65

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: exploit.py forges a KIMAI_REMEMBER cookie using a hardcoded default APP_SECRET and attempts to access protected paths to verify account takeover.This is the normal, documented behavior of the PoC exploit.exploit.py:103-130exploit.py:223-365
Network Activity: exploit.py makes HTTP requests to the user-supplied target URL to detect version and test cookie-based authentication.This is expected for a PoC that validates the vulnerability on a target instance.exploit.py:137-190exploit.py:327-360
File Write: exploit.py can write the forged cookie value to a user-specified file when --output is used.This is a convenience feature for saving the cookie, not a persistence mechanism.exploit.py:292-295

Review boundaries

What the analysis did not establish

Only 3 of 10 files in the repository are included as readable text; the other 7 files (including batch_pwn.py, quick_scan.py, deep_probe.py, probe_batch.py, shodan-scanner.py) are omitted, so the full toolkit behavior cannot be confirmed.
The evidence packet reports complete_artifact_coverage as false, indicating that not all files were analyzed.
The CVE records for CVE-2026-49865 and CVE-2026-52824 are absent from the acquired CVEList, so the official vulnerability description cannot be cross-referenced.
7 files (53,755 bytes) were omitted from the evidence packet and not reviewed. Their content is unknown.
The analysis is limited to static review of the provided text; no dynamic execution was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

cyeezy08/Kimai-CVE-2026-49865-POC