{"id":"CVE-2023-53957","aliases":["GHSA-cv8h-r7r5-vwj9"],"url":"https://o3.security/vulnerability/CVE-2023-53957","summary":"Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking","details":"Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. Attackers can trick victims into executing a crafted PHP script that captures and writes session cookie information to a file, enabling potential session hijacking.","published":"2025-12-19T21:05:52.561Z","modified":"2026-07-15T01:48:49.914353180Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"kimai/kimai","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/kimai/kimai/releases/tag/1.30.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53957.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53957"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/kimai-samesite-cookie-vulnerability-session-hijacking"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/51278"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:49.914353180Z"}}