Executive brief
HireFlow, an interview management system used by recruiters to track candidates and schedule interviews, is vulnerable to an attack that can allow unauthorized actions on behalf of logged-in users. By tricking an authenticated administrator or recruiter into visiting a malicious website, an attacker can silently change the victim's password, delete candidate records, or inject false interview feedback. This could lead to a complete takeover of administrative accounts and the loss or corruption of sensitive recruitment data.
Technical details
HireFlow v1.2 is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks CSRF token validation on all state-changing POST endpoints, including /profile, /candidates/delete/<id>, /feedback/add/<id>, and /interviews/add. Additionally, the SESSION_COOKIE_SAMESITE attribute is not configured, failing to provide modern browser-level protections. An unauthenticated remote attacker can exploit this by hosting a malicious page with an auto-submitting form; if an authenticated user visits this page, their browser will include session cookies in the cross-origin request. This allows for silent account takeover via password changes or unauthorized modification of the recruitment database. The issue is addressed in version 1.3.
Affected products
- StratonWebDesigners HireFlow 1.2
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Fixed in version 1.3