CVE-2026-80200

UNKNOWN 0.0

Kimai before 2.53.0 Open Redirect via RelayState

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks.

CWE	CWE-601
Vendor	kimai
Product	kimai
Published	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for kimai kimai

Be the first to know when new unknown vulnerabilities affecting kimai kimai are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

None

Availability

None

Affected Versions

kimai / kimai

0 < 2.53.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kimai/kimai/security/advisories/GHSA-3jp4-mhh4-gcgr vulncheck.com: https://www.vulncheck.com/advisories/kimai-before-2.53.0-open-redirect-via-relaystate

Credits

🔍 morimori-dev