Kimai Password Reset Link Remains Valid After Password Change
Date: 2026-07
Affected: composer/kimai/kimai
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-640

### Summary The LoginLink signature used for password reset URLs covers only the user's `id` — it does not include the password hash. After a user clicks a reset link and successfully changes their password, the same link remains valid for up to 2 additional uses within a 1-hour window. Anyone who intercepts or caches the original link can log in as the user even after the password has been changed. ### Details `config/packages/security.yaml:73-78` configures the login link: ```yaml login_link: check_route: link_login_check signature_properties: ['id'] lifetime: 900 max_uses: 3 ``` The HMAC signature covers only `id`, not `password`, `username`, or `email`. The effective lifetime for password reset links is extended to 3600 seconds by `PasswordResetController.php:106-119` via `getPasswordResetRetryLifetime()`. After the first successful use (where the user sets a new password), the `__pw_reset__` session flag is cleared by `WizardController.php:105`. Subsequent uses of the same link bypass the forced-password-reset wizard and grant a normal authenticated session. Symfony's `LoginLinkHandler::consumeLoginLink` decrements a per-link counter but allows up to 3 total uses. Re-issuing a new link does not invalidate the old one. The same vulnerability affects `UserLoginLinkCommand.php:77`, which generates admin-on-demand login links with the same signature scheme. ### PoC **Step 1 — Generate a password reset link:** ```bash docker exec <kimai_container> b


Mitigations:

Architectural layers (MAESTRO):