CVE-2026-45336 HireFlow: Use of Hard-coded Credentials
Attackers can forge admin session cookies using a hard-coded secret key to bypass authentication and gain administrative access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45336?
CVE-2026-45336 is a critical vulnerability in StratonWebDesigners HireFlow, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.
Weakness: CWE-798
Which versions are affected by CVE-2026-45336?
How do I fix CVE-2026-45336?
No fix has been published for CVE-2026-45336 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45336 exists.
Sources
Also known as GHSA-x53g-jr84-jrv5.