EUVD-2026-52654
GHSA-fhhf-pqcg-p3jc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Session replay over the network with no attacker privileges but requires prior token acquisition (UI:R); only confidentiality is impacted as no data modification or denial of service results.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (aka Session Replay).
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
AnalysisAI
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid session token to replay it indefinitely, effectively hijacking an authenticated user's session and gaining unauthorized access to HR data. Reported by TR-CERT (TR-26-0737), the flaw affects all 26.0 builds prior to 26.1 and carries a high confidentiality impact due to the sensitive nature of human resources data processed by the platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker first obtain a valid session token from a currently or previously authenticated HUMANIST user - this is the prerequisite encoded in UI:R. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting network accessibility and low attack complexity offset by required user interaction and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker intercepts a valid HUMANIST session token via a man-in-the-middle attack on an unencrypted connection, captures it from application logs, or extracts it through a stored XSS payload in an HR record field. Because the application does not expire or invalidate the token after the legitimate user logs out, the attacker replays the stolen token in subsequent requests to browse sensitive HR data such as employee records, payroll information, or organizational charts. … |
| Remediation | The primary remediation is to upgrade HUMANIST Digital Human Resources to version 26.1 or later, which resolves the session expiration deficiency per the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticat
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human R
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive s
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persiste
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to cr
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account f
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today