EUVD-2026-52655
GHSA-wfv2-mrh8-3fx5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible login endpoint, no auth required, limited confidentiality impact via account enumeration only; no integrity or availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
AnalysisAI
Observable response discrepancy in HUMANIST Digital Human Resources 26.0 exposes the system to unauthenticated account footprinting, enabling attackers to enumerate valid user accounts by analyzing differentiated server responses. The vulnerability is classified under CWE-204 and was reported by TR-CERT (Turkish national CERT), affecting the HR platform's authentication or account-lookup endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to the HUMANIST HR application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.3 (Medium) reflects a limited-impact flaw: confidentiality is partially affected (C:L) but integrity and availability are unaffected (I:N/A:N), and no scope change occurs (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a series of automated HTTP requests to the HUMANIST HR login or password-reset endpoint with varying usernames or email addresses, observing differences in server response content, HTTP status codes, or response timing. By correlating these discrepancies, the attacker builds a list of valid employee accounts and then uses that list as the target set for a credential-stuffing or spear-phishing campaign against HR or payroll staff. … |
| Remediation | The primary fix is to upgrade HUMANIST Digital Human Resources to version 26.1 or later, which resolves the observable response discrepancy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticat
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human R
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1
Session hijacking is possible in HUMANIST Digital Human Resources (versions 26.0 through before 26.1) due to sensitive s
Insufficient session expiration in HUMANIST Digital Human Resources version 26.0 allows an attacker who obtains a valid
Path traversal in HUMANIST Digital Human Resources version 26.0 enables authenticated remote attackers to read arbitrary
Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persiste
Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to cr
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today