Loading story…
Kimai disclosed a critical vulnerability, CVE-2026-52824, that allows unauthenticated attackers to forge Symfony-signed authentication artifacts and take over accounts on vulnerable deployments. The issue affects Kimai 2.57.0 and earlier, primarily in the official Docker image and also in bare-metal installations that retained the default .env.dist secret. Because the publicly known default APP_SECRET was used to sign remember-me cookies, login links, password reset URLs, and CSRF tokens, attackers could generate valid tokens without prior access.
The flaw can expose privileged accounts, including super_admin, because Kimai user IDs are sequential integers and high-value targets are therefore easier to predict. Accounts protected by two-factor authentication are not susceptible to direct takeover through this method, but unprotected accounts remain at risk. Kimai addressed the problem in version 2.58.0 by removing the hardcoded secret and generating a random APP_SECRET during Docker initialization when none is provided; no confirmed in-the-wild exploitation has been reported, though a proof of concept was created and withheld.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Kimai addressed CVE-2026-52824 in version 2.58.0 by removing the hardcoded default APP_SECRET and generating a random secret during Docker initialization when one is not supplied. The vulnerability affected versions up to and including 2.57.0 and could allow unauthenticated account takeover via forged Symfony-signed artifacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Docker disclosed a high-severity Docker Engine vulnerability, **CVE-2026-34040** (`CVSS 8.8`), that allows attackers to bypass authorization plugins and perform actions that should be blocked. The flaw stems from an incomplete fix for **CVE-2024-41110** and is triggered when a specially crafted oversized Docker API request causes the request body to be dropped before inspection by an AuthZ plugin. In affected environments, the plugin may approve container operations it would otherwise deny, opening a path to unauthorized privileged actions and potential host compromise. Researchers said an attacker with Docker API access could exploit the bug by padding a container-creation request beyond **1 MB** to launch a privileged container with access to the host filesystem, exposing sensitive assets such as **AWS credentials**, **SSH keys**, and **Kubernetes configurations**. The issue affects deployments that rely on authorization plugins inspecting request bodies, while environments not using those plugins are not impacted. Docker patched the vulnerability in **Docker Engine 29.3.1** and urged defenders to upgrade, restrict Docker API access, avoid AuthZ plugins that depend on request-body inspection, and use controls such as rootless mode, user namespace remapping, and least-privilege access to reduce risk.
Jul 23, 2026
Red Hat and the Keycloak project patched **CVE-2026-18963**, a critical flaw in the `keycloak-services` component that allows an unauthenticated remote attacker to take over arbitrary accounts, including administrators. The vulnerability affects the password recovery process: improper state validation in the reset-credentials flow lets a crafted request bypass the normal email verification or action-token step and proceed directly to changing a user's password. Red Hat assigned the issue a **CVSS 9.1** score and classified it as **CWE-640**. Affected versions include upstream Keycloak releases earlier than **26.7.2** and Red Hat Build of Keycloak versions earlier than **26.4.15** and **26.6.6**. Red Hat and CERT-PY urged organizations to apply the available security updates, while Red Hat also published a temporary mitigation for environments that cannot patch immediately by disabling the **"Forgot password"** feature across all realms. A Nuclei template pull request was also opened to detect the issue, underscoring rapid defender interest, although no verified public exploit or confirmed in-the-wild exploitation had been reported at publication time.
Aug 31, 2026
Red Hat released security updates for **Red Hat build of Keycloak** to fix a critical account-takeover vulnerability, tracked as `CVE-2026-18963`, in the `keycloak-services` component. The flaw affects the reset-credentials flow and allows an unauthenticated remote attacker to bypass the email verification step during password recovery, reset a victim's password, and take full control of the account. Affected versions include **26.4.x before 26.4.15** and **26.6.x before 26.6.6**, with scanners such as Nessus flagging vulnerable deployments based on reported version information. Red Hat addressed the issue in advisories **RHSA-2026:56523** and **RHSA-2026:56524**, releasing updated packages, container images, and an updated Operator for OpenShift. The advisories also bundle fixes for additional Keycloak security issues, including hidden group metadata disclosure, predictable account-linking hashes that could enable takeover through a malicious OIDC client, rotated client secret leakage via the Admin REST API, and a TOCTOU privilege-escalation bug. Red Hat advised customers to back up installations before upgrading, while **Red Hat JBoss Enterprise Application Platform Expansion Pack** was also listed as affected but did not yet have a vendor patch in the referenced reporting.
Aug 25, 2026