Kimai prior to version 2.54.0 contains a timing oracle in the TokenAuthenticator that leaks the existence of usernames. By sending requests with an X-AUTH-USER header and measuring response durations, an unauthenticated attacker can distinguish whether the password hash routine was executed for a valid user. The exploit has no built‑in login throttling, allowing rapid enumeration. This flaw is classified as a CWE‑208 information‑leak weakness, leading to partial disclosure of directory or user naming information, which may assist in further credential‑guessing or social‑engineering attacks.

The vulnerability affects installations of Kimai Kimai running any version earlier than 2.54.0. The exact version list is not provided beyond the major version boundary, so all releases before 2.54.0 are potentially vulnerable.

The CVSS score of 6.3 marks this as a medium‑severity flaw. Because EPSS is not available, the likelihood of exploitation is unclear, but the lack of throttling increases risk. The vulnerability is not listed in the CISA KEV catalog. Attackers may access publicly reachable API endpoints, so the primary attack vector is over HTTP using the X-AUTH-USER header; the exact service endpoint is not specified but is likely an authentication guard. No specific prerequisites beyond connectivity to the service are mentioned.