Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P N N N 5.3 .0036 27.5 —
AFFECTED Product Versions Fixed kimai unspecified 2.53.0
TIMELINE Aug 25 Reserved by VulnCheck Aug 25 Published (CNA: VulnCheck) Aug 28 RESCORED — CVE-2026-80200 (kimai). CVSS 0 → 5.3 (NVD).
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to attacker-controlled URLs for credential theft or phishing attacks.
| Date | Event | Detail |
|---|---|---|
| August 25, 2026 | Reserved | Reserved by VulnCheck |
| August 25, 2026 | Published | Published (CNA: VulnCheck) |
| August 28, 2026 | RESCORED | RESCORED — CVE-2026-80200 (kimai). CVSS 0 → 5.3 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| kimai | kimai | — | — | 2.53.0 |
Authoritative record: CVE-2026-80200 at cve.org
Vendors: kimai
Weaknesses: CWE-601
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-80200 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
