https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 00:15:36 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-52827 <p>Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICATED and App\API\Authentication\ApiRequestMatcher routes an existing session through the main firewall. A Scheb TwoFactorToken satisfies that access rule, and App\Voter\ApiVoter grants API access to its User, allowing an attacker with a valid account password to use authenticated REST API operations without entering the second factor even though web routes remain blocked. This issue is fixed in version 2.59.0.</p> <p>Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with IS_AUTHENTICATED and App\API\Authentication\ApiRequestMatcher routes an existing session through the main firewall. A Scheb TwoFactorToken satisfies that access rule, and App\Voter\ApiVoter grants API access to its User, allowing an attacker with a valid account password to use authenticated REST API operations without entering the second factor even though web routes remain blocked. This issue is fixed in version 2.59.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-52827 https://db.gcve.eu/vuln/ghsa-v8hx-4vx8-wc96 <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every `/api/*` endpoint.</p> <p>So after submitting just the password, the web UI correctly holds the browser at the TOTP screen (`/en/auth/2fa`), but the cookie from that same login response can be replayed against the API to act as the user without ever entering the second factor. This affects any account with 2FA enabled and requires only the account password.</p> <p>### Details</p> <p>#### Affected Component - The API firewall / authorization.</p> <p>`config/packages/security.yaml` guards the API with `{ path: &#39;^/api&#39;, roles: IS_AUTHENTICATED }`. During 2FA the session carries a Scheb `TwoFactorToken`, which satisfies `IS_AUTHENTICATED` (it is a real, non-anonymous token). `App\API\Authentication\ApiRequestMatcher` returns `!$request-&gt;hasPreviousSession()`, so a request that carries the login session skips the stateless API firewall and is served by the main session firewall; Scheb&#39;s `TwoFactorAccessDecider::isAccessible()` then evaluates `IS_AUTHENTICATED` to true for `^/api` and lets it through, and `App\Voter\ApiVoter` grants `API` to any token whose user is a `User`. Web routes are not affected because they require concrete roles (e.g. `ROLE_USER`) that a `TwoFactorToken` does not hold.</p> <p>### PoC</p> <p>_A PoC was provided, but removed f…</p> <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every `/api/*` endpoint.</p> <p>So after submitting just the password, the web UI correctly holds the browser at the TOTP screen (`/en/auth/2fa`), but the cookie from that same login response can be replayed against the API to act as the user without ever entering the second factor. This affects any account with 2FA enabled and requires only the account password.</p> <p>### Details</p> <p>#### Affected Component - The API firewall / authorization.</p> <p>`config/packages/security.yaml` guards the API with `{ path: &#39;^/api&#39;, roles: IS_AUTHENTICATED }`. During 2FA the session carries a Scheb `TwoFactorToken`, which satisfies `IS_AUTHENTICATED` (it is a real, non-anonymous token). `App\API\Authentication\ApiRequestMatcher` returns `!$request-&gt;hasPreviousSession()`, so a request that carries the login session skips the stateless API firewall and is served by the main session firewall; Scheb&#39;s `TwoFactorAccessDecider::isAccessible()` then evaluates `IS_AUTHENTICATED` to true for `^/api` and lets it through, and `App\Voter\ApiVoter` grants `API` to any token whose user is a `User`. Web routes are not affected because they require concrete roles (e.g. `ROLE_USER`) that a `TwoFactorToken` does not hold.</p> <p>### PoC</p> <p>_A PoC was provided, but removed f…</p> https://db.gcve.eu/vuln/ghsa-v8hx-4vx8-wc96