Horilla
CVE-2026-24038
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.
AnalysisAI
Horilla HRMS versions prior to 1.5.0 allow authenticated attackers to bypass two-factor authentication due to improper OTP validation that treats missing OTP fields as valid when the OTP has expired. Public exploit code exists for this vulnerability, enabling attackers with user credentials to gain unauthorized access to accounts, particularly administrative accounts with access to sensitive HR data and employee records. An attacker exploiting this flaw could manipulate employee information and compromise system-wide operations.
Technical ContextAI
Classified as CWE-287 (Improper Authentication). Affects Horilla. Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targ
RemediationAI
Fixed in version 1.5.0.. Restrict network access to the affected service where possible.
Horilla versions up to 1.5.0 contains a vulnerability that allows attackers to deploy phishing attacks (CVSS 8.0).
Horilla is a free and open source Human Resource Management System (HRMS). Rated high severity (CVSS 7.7), this vulnerab
Horilla is a free and open source Human Resource Management System (HRMS). Rated high severity (CVSS 7.2), this vulnerab
Horilla versions up to 1.5.0 is affected by unrestricted upload of file with dangerous type (CVSS 5.4).
Horilla HRMS versions 1.4.0 and above allow unauthenticated access to unpublished job postings through the /recruitment/
A vulnerability classified as critical was found in horilla up to 1.2.1. Rated medium severity (CVSS 5.3), this vulnerab
Horilla is a free and open source Human Resource Management System (HRMS). Rated medium severity (CVSS 4.8), this vulner
Horilla HRMS version 1.4.0 contains insufficient input validation in its XSS prevention function, allowing attackers to
Authenticated users in Horilla HRMS 1.5.0 can overwrite or corrupt any employee's documents via insecure direct object r
Horilla is a free and open source Human Resource Management System (HRMS). [CVSS 4.3 MEDIUM]
Horilla HRMS 1.4.0 contains insufficient server-side authorization checks that permit low-privileged employees to self-a
Broken access control in Horilla HRMS 1.5.0 helpdesk module allows any authenticated employee to view support ticket att
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today