Executive brief
HireFlow, a web-based interview and candidate management system, contains a security flaw where it uses a publicly known secret key to protect user sessions. This allows an attacker to create fake login credentials and gain full administrative access to the system without a password. Once inside, an attacker could access sensitive candidate data, modify hiring records, or disrupt recruitment operations.
Technical details
The vulnerability is a Use of Hard-coded Credentials (CWE-798) within the HireFlow interview management system. The application's 'app.py' file assigns a static string ('supersecret123') to the Flask secret_key, which is used by the itsdangerous library to cryptographically sign session cookies. Because this key is publicly available in the source code, a remote, unauthenticated attacker can locally sign a crafted session cookie containing 'role=admin' and arbitrary 'user_id' values. When presented to the server, the application validates the signature against the hard-coded key and grants the attacker full administrative privileges. This issue is resolved in version 1.3 by removing the hard-coded key.
Affected products
- StratonWebDesigners HireFlow <= 1.2
Timeline
- 2026-05-08: patched: Version 1.3 released
- 2026-05-13: advisory: GitHub Security Advisory GHSA-x53g-jr84-jrv5 published
- 2026-07-16: disclosed: CVE-2026-45336 published to NVD