https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T19:21:19.800371+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-80199 fkie_cve-2026-80199 2026-09-29T19:21:19.818688+00:00

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.

 https://db.gcve.eu/vuln/ghsa-p6f7-72pm-r6j9 GHSA-p6f7-72pm-r6j9 2026-09-29T19:21:19.818736+00:00

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username enumeration with no login throttling protection.