CVE-2023-53957: 
PHP vulnerability analysis and mitigation

CVE-2023-53957 is a SameSite cookie vulnerability (CWE-1275) in Kimai version 1.30.10, a popular open-source time-tracking application. The flaw allows attackers to steal user session cookies by tricking victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling session hijacking. The CVE was assigned by VulnCheck and published on December 19, 2025, with NVD initial analysis completed February 19, 2026. It carries a CVSS v3.1 base score of 8.8 (High) per NIST NVD, and a CVSS v4.0 base score of 8.5 (High) per VulnCheck (VulnCheck Advisory, Kimai Release).

The vulnerability is classified as CWE-1275 (Sensitive Cookie with Improper SameSite Attribute), meaning Kimai 1.30.10 fails to properly configure the SameSite attribute on session cookies, leaving them exposed to cross-site request scenarios. An attacker exploits this by crafting a malicious PHP script that, when executed by a victim (e.g., via phishing or social engineering), captures the victim's session cookie and writes it to an attacker-controlled file. The attack requires no privileges on the target system but does require user interaction — the victim must be tricked into running the malicious script. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation enables complete account compromise through session hijacking, allowing an attacker to impersonate a legitimate Kimai user without requiring their credentials. An attacker in possession of a stolen session cookie can perform any action the victim is authorized to perform, including accessing time-tracking records, project data, and potentially administrative functions depending on the victim's role. While availability impact is rated as none (the application itself is not disrupted), confidentiality and integrity are both rated High, reflecting the risk of unauthorized data access and manipulation (VulnCheck Advisory).

A public proof-of-concept exploit is available on Exploit-DB (exploit ID 51278), added to NVD references on February 19, 2026. There is no current evidence of active in-the-wild exploitation or known threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039% (0.000390), indicating a low probability of exploitation in the near term (Exploit-DB PoC, Feedly).

1. Reconnaissance: Identify publicly accessible Kimai instances running version 1.30.10 using web search, Shodan, or Censys queries targeting Kimai login pages or version indicators.
2. Craft malicious PHP script: Develop a PHP script designed to capture the victim's Kimai session cookie from their browser when executed, leveraging the missing or misconfigured SameSite cookie attribute to allow cross-site cookie access.
3. Deliver payload via social engineering: Trick the target Kimai user into executing the crafted PHP script — for example, by embedding it in a phishing email, a malicious link, or a compromised web page that the victim visits while authenticated to Kimai.
4. Capture session cookie: The malicious script captures the victim's active Kimai session cookie and writes it to a file accessible to the attacker (e.g., on an attacker-controlled server).
5. Session hijacking: The attacker uses the stolen session cookie in their own browser or via HTTP requests (e.g., using curl with the Cookie header) to authenticate to the Kimai instance as the victim, gaining full access to their account (Exploit-DB PoC, VulnCheck Advisory).

• Network: Outbound HTTP/HTTPS requests from a victim's browser to unexpected external domains shortly after visiting a Kimai-related page; unusual session cookie transmission to non-Kimai domains.
• Logs: Kimai access logs showing the same session token used from two distinct IP addresses or geographic locations in a short time window; authentication events from unexpected IP addresses.
• File System: Presence of unexpected PHP scripts on web servers accessible to Kimai users that contain cookie-capture logic; newly created files containing session cookie strings in web-accessible directories.
• Process/Application: Kimai user accounts performing actions inconsistent with normal user behavior (e.g., bulk data exports, configuration changes) without corresponding user-initiated activity.

Organizations should upgrade Kimai beyond version 1.30.10 to a patched release as the primary remediation step, as patches are available for versions after 1.30.10 (Kimai Release). As interim mitigations, administrators should implement network-level controls to restrict access to Kimai deployments (e.g., VPN or IP allowlisting), and educate users about phishing and the risks of executing unknown scripts. Additional session security measures such as short session timeouts, IP-based session binding, and monitoring for anomalous session activity are also recommended (VulnCheck Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article titled "Critical Session Hijacking Vulnerability CVE-2023-53957 Strikes Kimai with SameSite Flaw," and was also highlighted in their weekly roundup for December 14–21, 2025 (The Hacker Wire). The CVE was also noted in a CISA vulnerability bulletin for the week of December 15, 2025. Social media activity was observed on Mastodon (infosec.exchange) and Bluesky, though no significant researcher controversy or vendor dispute has been noted.