GHSA-cv8h-r7r5-vwj9HighCVSS 9.8

Kimai contains a SameSite cookie vulnerability

Published
December 19, 2025
Last Modified
February 20, 2026

🔗 CVE IDs covered (1)

📋 Description

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

🎯 Affected products1

  • composer/kimai/kimai:<= 1.30.10

🔗 References (4)