CyberRota Analysis
AI-GeneratedThe HireFlow web-based interview management system is vulnerable due to a hard-coded Flask secret_key in versions 1.2 and earlier, which allows unauthenticated attackers to forge session cookies with elevated privileges, including admin access. This critical vulnerability poses a significant risk of unauthorized access and potential manipulation of hiring processes. Organizations using affected versions should prioritize immediate updates to version 1.3 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secret_key used to sign session cookies, allowing unauthenticated attackers who know the public source value to forge cookies containing role=admin and user_id values and bypass authentication. The advisory lists version 1.3 as fixed.