CVE-2026-52824

Classification basis

The primary artifact is classified as an exploit because the main Python script (exploit.py) contains code that forges a valid authentication cookie and uses it to gain unauthorized access to a target application, which is the definition of an exploit. The README explicitly describes it as a 'Proof-of-concept exploit toolkit' and details the attack chain from advisory to admin session.

Requirements

• Target must be a Kimai instance ≤ 2.57.0 using the default APP_SECRET (change_this_to_something_unique) as shipped in Docker or .env.dist.README.md:5exploit.py:8-11
• The attacker must know or guess a valid username (e.g., admin, super_admin) and the corresponding user ID is sequential (admin = id:1).README.md:13README.md:42

Observed behavior

• The exploit script computes a constant FieldsHash (SHA256 of empty string) and uses the known default APP_SECRET to compute an HMAC-SHA256 signature, then assembles a forged KIMAI_REMEMBER cookie.exploit.py:70-100exploit.py:103-130
• The script sets the forged cookie in an HTTP session and attempts to access protected paths (e.g., /en/dashboard, /en/admin/user/) to verify successful authentication bypass.exploit.py:311-365
• The README describes the toolkit as containing a single-target exploit, a multi-threaded batch exploitation script, a scanner, version probes, and a Shodan discovery script.README.md:56-65

Observables

Exploit Behavior

Payload withheldThis is the normal, documented behavior of the PoC exploit.exploit.py:103-130exploit.py:223-365

Network Activity

Payload withheldThis is expected for a PoC that validates the vulnerability on a target instance.exploit.py:137-190exploit.py:327-360

File Write

Payload withheldThis is a convenience feature for saving the cookie, not a persistence mechanism.exploit.py:292-295

Classification basis

The artifact is a README.md file containing a technical analysis of CVE-2026-52824, including root cause, proof-of-concept code snippet, detection commands, and remediation steps. It does not function as a standalone exploit or scanner; it is a documentation writeup.

Requirements

• Target Kimai instance uses the default APP_SECRET 'change_this_to_something_unique'README.md:21-25
• Attacker knows or guesses a valid username and user IDREADME.md:79-81

Observed behavior

• Describes forging a login link by computing an HMAC with the known secret and user IDREADME.md:42-67
• Explains that a successful forged request returns a 302 redirect and sets a KIMAI_REMEMBER cookieREADME.md:69

Observables

Proof Of Concept Code

Payload withheldDemonstrates the CVE-2026-52824 vulnerability by forging a login link. The code is presented as a static example and does not perform any hidden or harmful action against the reviewer.README.md:42-67