CVE-2026-24038
HighSummary
Horilla version 1.4.0 has a vulnerability in OTP handling logic where a flawed equality check can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the comparison user_otp == otp passes, allowing complete bypass of two-factor authentication without providing a valid OTP.
Risk Assessment
Risk of complete 2FA bypass, potentially leading to compromise of administrative accounts, breach of sensitive HR data, manipulation of employee records, and system-wide abuse.
Recommendation
Immediately upgrade Horilla to version 1.5.0, which fixes this vulnerability.
Other vulnerabilities in Horilla
See all- CVE-2026-40867High
Horilla version 1.5.0 has a broken access control vulnerability in the helpdesk attachment viewer that allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents.
- CVE-2026-40866High
Horilla version 1.5.0 has an IDOR vulnerability in the employee document upload endpoint that allows any authenticated user to overwrite, replace, or corrupt another employee's document by changing the document ID in the upload request. This enables unauthorized modification of HR records.
- CVE-2026-40865High
Horilla version 1.5.0 has an IDOR vulnerability in the employee document viewer that allows any authenticated user to access other employees' uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.
- CVE-2026-24010High
Horilla before version 1.5.0 has a critical file upload vulnerability that, with social engineering, allows authenticated users to deploy phishing attacks. By uploading a malicious HTML file disguised as a profile picture, an attacker can create a convincing login page replica that steals user credentials.
Original NVD description (English source)
Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.