Kimai versions before 2.53.0 allow an attacker who controls the IdP to supply malicious RelayState values that are not validated by the SAML authentication success handler. This flaw means an authenticated user can be redirected to any attacker‑controlled URL, facilitating phishing attempts or credential theft. The weakness is identified as CWE‑601, the classic open redirect issue.

The vulnerability affects the Kimai project, specifically all releases prior to version 2.53.0. Users running Kimai 2.52.x or earlier are at risk.

Because this redirect is triggered after a successful SAML authentication, an adversary must have access to the IdP or privileges to inject RelayState parameters. Once that condition is met, exploitation is straightforward: the user is automatically redirected to a malicious site. The EPSS score is not available and the flaw is not currently listed in the CISA KEV catalog, but the lack of input validation makes the risk significant for environments using untrusted IdPs.