CVE-2023-53957: Kimai contains a SameSite cookie vulnerability

December 19, 2025 (updated February 20, 2026)

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.

References

github.com/advisories/GHSA-cv8h-r7r5-vwj9
github.com/kimai/kimai
nvd.nist.gov/vuln/detail/CVE-2023-53957
www.exploit-db.com/exploits/51278
www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking

Code Behaviors & Features

Detect and mitigate CVE-2023-53957 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →