Is CVE-2026-45336 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45336 being exploited in the wild.

How severe is CVE-2026-45336?

Critical severity, with a CVSS score of 10, published 16 July 2026.

Which products and versions are affected?

StratonWebDesigners HireFlow <= 1.2.

Is there a fix for CVE-2026-45336?

A patch was published on 2026-05-08: Version 1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45336 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45336?

Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45336: StratonWebDesigners HireFlow authentication bypass via hard-coded secret key

Q: Is there a fix for CVE-2026-45336?

A patch was published on 2026-05-08: Version 1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45336 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45336?

Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45336 · Severity: critical · CVSS 10 · Published 2026-07-16

HireFlow, a web-based interview and candidate management system, contains a security flaw where it uses a publicly known secret key to protect user sessions. This allows an attacker to create fake login credentials and gain full administrative access to the system without a password. Once inside, an attacker could access sensitive candidate data, modify hiring records, or disrupt recruitment operations.

Technologies: StratonWebDesigners HireFlow. Vendors: StratonWebDesigners.

Quick answers

Is CVE-2026-45336 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45336 being exploited in the wild.
How severe is CVE-2026-45336?: Critical severity, with a CVSS score of 10, published 16 July 2026.
Which products and versions are affected?: StratonWebDesigners HireFlow <= 1.2.
Is there a fix for CVE-2026-45336?: A patch was published on 2026-05-08: Version 1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45336 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45336?: Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Use of Hard-coded Credentials (CWE-798) within the HireFlow interview management system. The application's 'app.py' file assigns a static string ('supersecret123') to the Flask secret_key, which is used by the itsdangerous library to cryptographically sign session cookies. Because this key is publicly available in the source code, a remote, unauthenticated attacker can locally sign a crafted session cookie containing 'role=admin' and arbitrary 'user_id' values. When presented to the server, the application validates the signature against the hard-coded key and grants the attacker full administrative privileges. This issue is resolved in version 1.3 by removing the hard-coded key.

Affected products

StratonWebDesigners HireFlow <= 1.2

Timeline

2026-05-08: patched: Version 1.3 released
2026-05-13: advisory: GitHub Security Advisory GHSA-x53g-jr84-jrv5 published
2026-07-16: disclosed: CVE-2026-45336 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.