EUVD-2026-29114
GHSA-2qgc-8m4g-h724
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /candidates/delete/<id>, feedback submission at /feedback/add/<id>, interview scheduling at /interviews/add) are vulnerable to CSRF. An attacker who can trick an authenticated user into visiting a malicious page can silently change the victim's password, delete records, or inject arbitrary data on their behalf. The SESSION_COOKIE_SAMESITE attribute is also not configured, removing the browser-level CSRF defense.
AnalysisAI
Cross-Site Request Forgery (CSRF) in HireFlow v1.2 allows remote attackers to perform unauthorized actions on behalf of authenticated users without token validation on any state-changing endpoint. An attacker can craft malicious web pages to silently change victim passwords, delete candidate records, inject feedback, or schedule interviews when visited by an authenticated user. The absence of SESSION_COOKIE_SAMESITE configuration removes browser-level CSRF defenses. Publicly available exploit code exists (SSVC exploitation status: POC), though EPSS score of 0.02% (4th percentile) suggests limited widespread targeting. CVSS 8.1 reflects high confidentiality and integrity impact requiring only user interaction (UI:R), making this a realistic threat in phishing scenarios despite no active exploitation confirmed at time of analysis.
Technical ContextAI
CSRF (CWE-352) is a web security vulnerability that forces authenticated users to execute unwanted actions on a web application. HireFlow v1.2, a Python-based interview management system available on SourceCodester and GitHub (StratonWebDesigners/HireFlow), fails to implement anti-CSRF tokens on POST endpoints handling password changes (/profile), candidate deletion (/candidates/delete/<id>), feedback submission (/feedback/add/<id>), and interview scheduling (/interviews/add). The application additionally fails to configure SESSION_COOKIE_SAMESITE attribute, which would normally instruct browsers to prevent cookies from being sent with cross-site requests. This dual failure removes both application-level and browser-level CSRF protections, allowing attackers to exploit standard HTML form submission or JavaScript fetch() calls from malicious third-party sites while the victim's authentication session remains active.
RemediationAI
Upgrade to a patched version of HireFlow if available by checking the official GitHub repository (https://github.com/StratonWebDesigners/HireFlow) for security updates addressing CVE-2026-38566. No vendor-released patch version is confirmed in available data at time of analysis. If no patch exists, implement the following compensating controls: (1) Add CSRF token generation and validation to all state-changing POST endpoints using a framework-native mechanism (e.g., Flask-WTF for Flask applications or Django CSRF middleware) - requires code modification and testing of all forms. (2) Configure SESSION_COOKIE_SAMESITE='Lax' or 'Strict' in application configuration to enable browser-level protection (Strict prevents all cross-site cookie transmission but may break legitimate cross-site workflows; Lax allows top-level navigation). (3) Implement additional authentication challenges (re-authentication or CAPTCHA) for high-risk operations like password changes and candidate deletion - adds user friction. (4) Deploy Web Application Firewall (WAF) rules to detect and block requests with suspicious Referer/Origin headers not matching the application domain - may cause false positives with legitimate proxy configurations. (5) Educate users to log out after HireFlow sessions and avoid clicking unknown links while authenticated - relies on user behavior. Refer to researcher disclosure at https://github.com/hijackedamygdala/CVE-Disclosures/tree/main/HireFlow/CVE-2026-38566 for technical details on affected endpoints.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today