CVE-2026-45336

Name of the Vulnerable Software and Affected Versions HireFlow versions prior to 1.3

Description HireFlow is a web-based interview management system used for candidate management, interview scheduling, and hiring progress tracking. In the app.py file, the application assigns a hard-coded Flask secret key used to sign session cookies. An unauthenticated attacker with knowledge of this public source value can forge cookies containing the role=admin and user id variables to bypass authentication.

Recommendations Update to version 1.3.