EUVD-2026-44987Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Remotely forgeable admin cookie needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); full admin takeover yields C:H/I:H/A:H, and impact stays within the vulnerable app (S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.
Articles & Coverage 1
AnalysisAI
Authentication bypass in HireFlow interview management system (versions 1.2 and earlier) lets unauthenticated remote attackers forge signed session cookies because app.py ships a hard-coded Flask secret_key. Since the key is present in the public source tree, any attacker can mint cookies asserting role=admin and arbitrary user_id values to gain full administrative access. Rated CVSS 10.0; no public exploit is identified at time of analysis, though the flaw is trivially reproducible from the disclosed source value.
Technical ContextAI
HireFlow is a Python/Flask web application (CPE cpe:2.3:a:stratonwebdesigners:hireflow) that uses Flask's default client-side session mechanism, where session data is stored in a cookie signed (not encrypted) with the application's secret_key. This is a textbook CWE-798 Use of Hard-coded Credentials: because secret_key is embedded as a static literal in app.py and the repository is public, the signing secret is effectively known to everyone. Flask's itsdangerous signing only guarantees integrity when the key is secret; with the key exposed, an attacker can locally construct and sign a session payload (e.g. {"role":"admin","user_id":1}) that the server accepts as authentic, defeating all cookie-based access control.
RemediationAI
Upgrade to HireFlow v1.3, the fixed release per the vendor advisory (https://github.com/StratonWebDesigners/HireFlow/releases/tag/v1.3 and GHSA-x53g-jr84-jrv5). If immediate upgrade is not possible, replace the hard-coded Flask secret_key with a high-entropy value loaded from an environment variable or secrets file (e.g. os.environ['SECRET_KEY'] or secrets.token_hex(32)) and never commit it to source control - this alone neutralizes the cookie-forgery vector, though it invalidates all existing sessions and forces re-login. As a compensating control, restrict network access to the application (VPN/IP allowlist) to limit who can reach the login and cookie-bearing endpoints, accepting the trade-off of reduced accessibility for legitimate remote users. Because the fix version's release notes reference unrelated CVE IDs, confirm the secret_key change is actually present in the deployed build before considering the issue closed.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today