CVE-2023-53957
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Dec 19, 2025
CISA due date
—
The record
Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | kimai/kimai | 0 | No fix |
Related vulnerabilities
- GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability Same vulnerability
- CVE-2026-28685 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- GHSA-v33r-r6h2-8wr7 Kimai's API invoice endpoint missing customer-level access control (IDOR) Also affects kimai/kimai
- GHSA-9278-6hcj-2p4j Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions Also affects kimai/kimai
- CVE-2019-25317 Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to… Also affects kimai/kimai
- GHSA-jg2j-2w24-54cg Kimai has an Authenticated Server-Side Template Injection (SSTI) Also affects kimai/kimai
- CVE-2026-23626 Kimai is a web-based multi-user time-tracking application. Also affects kimai/kimai
- CVE-2026-81888 @hono/oauth-providers is Authentication middleware for Hono. CWE-1275