StratonWebDesigners HireFlow up to 1.2 Session Management app.py role/user_id hard-coded key

Summaryinfo

A vulnerability marked as critical has been reported in StratonWebDesigners HireFlow up to 1.2. Impacted is an unknown function of the file app.py of the component Session Management. Performing a manipulation of the argument role/user_id results in hard-coded key. This vulnerability was named CVE-2026-45336. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in StratonWebDesigners HireFlow up to 1.2. This affects an unknown code of the file app.py of the component Session Management. The manipulation of the argument role/user_id with an unknown input leads to a hard-coded key vulnerability. CWE is classifying the issue as CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-45336 since 05/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 1.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-44987). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• StratonWebDesigners

Name

• HireFlow

Version

• 1.0
• 1.1
• 1.2

Website

• Product: https://github.com/StratonWebDesigners/HireFlow/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion