HUMANIST Digital HR CVE-2026-14219

Exploitation requires the attacker to hold a low-privileged authenticated account within the HUMANIST Digital Human Resources application (PR:L per CVSS vector) in order to generate or access the redirect endpoint. The victim must actively click the crafted link (UI:R), meaning passive exploitation or drive-by scenarios are not applicable here. The vulnerability is limited to HUMANIST Digital Human Resources versions in the 26.0 release line prior to 26.1; the specific redirect parameter or endpoint that accepts unvalidated destination URLs is not named in available data. No special server-side configuration appears required beyond a standard 26.0 deployment. Exploitation is constrained by the need for an insider or compromised low-privilege account to initiate the attack, and by the social engineering step required to induce victim clicks.

The CVSS 3.1 score of 5.4 (Medium) reflects the bounded real-world impact: authentication is required (PR:L), and a victim must actively follow the crafted link (UI:R), which substantially limits opportunistic exploitation. CVSS Scope:Changed captures the cross-domain trust abuse that underpins phishing, but Confidentiality:Low and Integrity:Low indicate the vulnerability itself does not directly exfiltrate data - harm depends on downstream phishing success. No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public exploit code has been identified. Real-world risk is primarily a phishing enablement concern: the HUMANIST brand lends the malicious link credibility with HR system users, making credential-harvesting attacks more convincing. This is a genuine but not urgent remediation priority - patch during the next maintenance window rather than as an emergency response.

An authenticated user with a low-privilege account logs into HUMANIST Digital HR and constructs a URL containing a redirect parameter pointing to an attacker-controlled phishing page mimicking the HUMANIST login screen. The attacker sends this URL to HR department employees or job applicants via email or internal messaging; when a recipient clicks the link (originating from the trusted HUMANIST domain), they are silently forwarded to the phishing site and prompted to re-enter their credentials. No public exploit code has been identified, though the technique requires no special tooling beyond URL crafting.