What is the CVSS score of CVE-2026-45336?

CVE-2026-45336 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of HireFlow are affected by CVE-2026-45336?

HireFlow interview management system versions 1.2 and earlier contain a critical authentication bypass that allows unauthenticated attackers to forge administrative session credentials and assume…. A patch is available.

How to fix or mitigate CVE-2026-45336?

Within 24 hours: Identify all deployments of HireFlow versions 1.2 or earlier and immediately restrict network access to these systems, disabling external connectivity where feasible. Within 7 days: Contact HireFlow support to confirm patch availability and request emergency guidance; if no patch is available, implement compensating controls including network segmentation to trusted networks only, mandatory VPN access, and comprehensive administrative activity logging. Within 30 days: Deploy a patched version of HireFlow if released by the vendor, or execute migration to an alternative interview management platform with current security posture; conduct forensic review of all administrative access logs dating back to the system's initial deployment to detect unauthorized session activity.

HireFlow CVE-2026-45336

EUVD-2026-44987 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-07-16 GitHub_M

Authentication Bypass Python Hireflow

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.8 CRITICAL

Remotely forgeable admin cookie needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); full admin takeover yields C:H/I:H/A:H, and impact stays within the vulnerable app (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 16, 2026 - 19:33 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 17:45 vuln.today

Analysis Generated

Jul 16, 2026 - 17:45 vuln.today

CVE Published

Jul 16, 2026 - 17:03 cve.org

CRITICAL 10.0

DescriptionCVE.org

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.

Articles & Coverage 1

News Critical Authentication Bypass in HireFlow Interview Management System - CVE-2026-45336 Jul 17, 2026

AnalysisAI

Authentication bypass in HireFlow interview management system (versions 1.2 and earlier) lets unauthenticated remote attackers forge signed session cookies because app.py ships a hard-coded Flask secret_key. Since the key is present in the public source tree, any attacker can mint cookies asserting role=admin and arbitrary user_id values to gain full administrative access. Rated CVSS 10.0; no public exploit is identified at time of analysis, though the flaw is trivially reproducible from the disclosed source value.

Technical ContextAI

HireFlow is a Python/Flask web application (CPE cpe:2.3:a:stratonwebdesigners:hireflow) that uses Flask's default client-side session mechanism, where session data is stored in a cookie signed (not encrypted) with the application's secret_key. This is a textbook CWE-798 Use of Hard-coded Credentials: because secret_key is embedded as a static literal in app.py and the repository is public, the signing secret is effectively known to everyone. Flask's itsdangerous signing only guarantees integrity when the key is secret; with the key exposed, an attacker can locally construct and sign a session payload (e.g. {"role":"admin","user_id":1}) that the server accepts as authentic, defeating all cookie-based access control.

RemediationAI

Upgrade to HireFlow v1.3, the fixed release per the vendor advisory (https://github.com/StratonWebDesigners/HireFlow/releases/tag/v1.3 and GHSA-x53g-jr84-jrv5). If immediate upgrade is not possible, replace the hard-coded Flask secret_key with a high-entropy value loaded from an environment variable or secrets file (e.g. os.environ['SECRET_KEY'] or secrets.token_hex(32)) and never commit it to source control - this alone neutralizes the cookie-forgery vector, though it invalidates all existing sessions and forces re-login. As a compensating control, restrict network access to the application (VPN/IP allowlist) to limit who can reach the login and cookie-bearing endpoints, accepting the trade-off of reduced accessibility for legitimate remote users. Because the fix version's release notes reference unrelated CVE IDs, confirm the secret_key change is actually present in the deployed build before considering the issue closed.