EUVD-2026-52652
GHSA-chm9-7crh-67fc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because token harvesting requires log access, Referer interception, or MITM; PR:N since no application authentication needed by the attacker; no availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
AnalysisAI
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive session tokens being transmitted as GET request query string parameters. Exposure occurs through server access logs, browser history, and HTTP Referer headers leaking to downstream systems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker obtain the session token from one of the surfaces where GET query strings are exposed: server-side access logs (requires read access to log files or a log aggregation system), HTTP Referer headers forwarded when a user navigates from the HR application to an external domain (the external domain receives the full URL including the token), browser history accessible on the user's endpoint, or a network intermediary (proxy, MITM) positioned between client and server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.4 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N reflects a nuanced picture: while the attack requires no authentication or user interaction, AC:H explicitly signals that exploitation is not straightforward and requires specific enabling conditions such as access to log infrastructure, a network interception position, or control of a page that receives Referer headers from the HR application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with read access to the application's web server or proxy access logs (e.g., a system administrator or a compromised log aggregation service) extracts a valid session token from a logged URL query string belonging to an authenticated HR employee or administrator. The attacker replays that token via a crafted request, gaining full access to the victim's HUMANIST DHRS session, including HR records, payroll data, and employee PII. … |
| Remediation | Upgrade HUMANIST Digital Human Resources to version 26.1, which resolves this issue per the vendor-confirmed affected range (26.0 before 26.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit production HUMANIST deployments to identify all systems running version 26.0 and review HR system access logs for anomalous session activity or external credential queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticat
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human R
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persiste
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to cr
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account f
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today