Which versions of Prospero Flow CRM are affected by CVE-2026-19871?

Roskus Prospero Flow CRM contains a critical authentication bypass that affects all newly onboarded employee accounts, exposing them to unauthorized access via a universally known hard-coded…. A patch is available.

How to fix or mitigate CVE-2026-19871?

Within 24 hours: verify your current Roskus Prospero Flow CRM version and document all affected instances and employee accounts; contact Roskus support directly requesting emergency patch status and delivery timeline; reset passwords on all newly onboarded employee accounts and enforce strong password complexity requirements that prevent defaults; enable multi-factor authentication (MFA) for all CRM access immediately; restrict CRM network access to your corporate network or VPN only. Within 7 days: audit all CRM access logs for suspicious login attempts, unusual data access, or accounts accessed outside normal business hours; implement enhanced audit logging specifically for account creation and authentication events; establish an incident response process to handle any confirmed unauthorized access; obtain written confirmation from Roskus of the patch release date. Within 30 days: deploy the vendor-released patch when available and test thoroughly across all environments; conduct a security review of all customer data accessed through compromised accounts; complete remediation reporting to senior leadership and relevant stakeholders.

Prospero Flow CRM CVE-2026-19871

Q: What is the CVSS score of CVE-2026-19871?

CVE-2026-19871 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-58665 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-08-14 4daa8cea-433a-44bd-9456-53b127fc289a

GHSA-pw58-qr35-gpr4

Authentication Bypass

9.3

CVSS 4.0 · Vendor: 4daa8cea-433a-44bd-9456-53b127fc289a

Severity by source

Vendor (4daa8cea-433a-44bd-9456-53b127fc289a) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated network login with a known static password (PR:N/AC:L); full account takeover yields high confidentiality and integrity, but no availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (4daa8cea-433a-44bd-9456-53b127fc289a).

CVSS VectorVendor: 4daa8cea-433a-44bd-9456-53b127fc289a

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 14, 2026 - 15:02 EUVD

Source Code Evidence Fetched

Aug 14, 2026 - 14:30 vuln.today

Analysis Generated

Aug 14, 2026 - 14:30 vuln.today

CVE Published

Aug 14, 2026 - 14:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

AnalysisAI

Authentication bypass in Roskus Prospero Flow CRM before 5.15.9 lets unauthenticated remote attackers log in as any employee onboarded through the standard HR flow using only that employee's email address. The employee save controller assigns a hard-coded fallback password of "changeme" (CWE-798) because the onboarding form exposes no password field, leaving newly created accounts with a universally known credential. No public exploit code or CISA KEV listing is identified at time of analysis, but the flaw is trivially reproducible from the public fix commit, and the CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

Prospero Flow CRM is a Laravel (PHP) based human-resources/CRM application. The root cause is CWE-798 (Use of Hard-coded Credentials): in EmployeeSaveController the account creation logic read the password via bcrypt($request->input('password', 'changeme')), so when the onboarding form omitted a password field the framework's default-value fallback silently bcrypt-hashed the literal string "changeme" for every onboarded user. Because the hash is valid and deterministic, standard Laravel authentication accepts "changeme" for any such account. The GitHub fix commit (5cc01ed) replaces the fallback with bcrypt(Str::random(32)), sets must_change_password = true, assigns the 'User' role, and dispatches a password-reset link, converting the account to a no-known-password state until the employee sets their own.

RemediationAI

Vendor-released patch: upgrade to Prospero Flow CRM 5.15.9 or later, which replaces the hard-coded fallback with a random 32-character password, forces a password change, and emails a reset link (see fix commit 5cc01ed958db4ad0a026a8daa1c6a8bb98a43e66). Because upgrading alone does not remediate already-onboarded accounts, immediately force a password reset for every user created through the onboarding flow and invalidate the "changeme" credential - query for and expire any account whose password still matches the default. If patching cannot be done immediately, compensating controls include restricting the login/onboarding endpoints to trusted networks or VPN (trade-off: blocks legitimate remote staff), and setting must_change_password / mandatory reset on first login for existing accounts. Consult the CNA advisory at https://secur0.com/en/cna/cve-list/cve-2026-19871-hardcoded-credentials-in-prospero-flow-crm-employee-onboarding for vendor guidance.