CVE-2026-45336
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.
Risk Assessment
An attacker can gain full administrative access to the recruitment management system, enabling theft of candidate data, modification of interview schedules, and takeover of the hiring process.
Recommendation
Immediately update HireFlow to version 1.3 or later, which removes the hard-coded secret_key. If an update is not possible, replace the secret_key with a randomly generated value and store it as an environment variable.
Original NVD description (English source)
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.