The official Kimai Docker image ships with "APP_SECRET=change_this_to_something_unique" as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting "APP_SECRET" runs with a publicly-known Symfony "kernel.secret", enabling an unauthenticated attacker to forge HMAC-signed cookies and login links to take over any account including super_admin.