GitHub Advisoryadvisory · Packagist

GHSA-cv8h-r7r5-vwj9 Kimai contains a SameSite cookie vulnerability

HIGH Published 2025-12-19 Modified 2026-02-20 Official page ↗
Aliases
CVE-2023-53957
Ecosystem
Packagist
Packages
kimai/kimai
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1275
Reviewed
2026-02-20

Affected packages

• Packagist kimai/kimai: <= 1.30.10 (no fix yet)

Description

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

Related

Alias · CVE (1)

  • CVE-2023-53957 Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. vulnerability

Weakness · CWE (1)

  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute weakness

References