# CVE-2026-45336: StratonWebDesigners HireFlow authentication bypass via hard-coded secret key

Source: https://junglewise.ai/threats/cve-2026-45336-stratonwebdesigners-hireflow-authentication-bypass-via-hard-coded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-45336 · Severity: critical · CVSS 10 · Published 2026-07-16

HireFlow, a web-based interview and candidate management system, contains a security flaw where it uses a publicly known secret key to protect user sessions. This allows an attacker to create fake login credentials and gain full administrative access to the system without a password. Once inside, an attacker could access sensitive candidate data, modify hiring records, or disrupt recruitment operations.

Technologies: [StratonWebDesigners HireFlow](https://junglewise.ai/threats/technologies/hireflow). Vendors: [StratonWebDesigners](https://junglewise.ai/threats/vendors/stratonwebdesigners).

## Quick answers

**Is CVE-2026-45336 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45336 being exploited in the wild.

**How severe is CVE-2026-45336?** Critical severity, with a CVSS score of 10, published 16 July 2026.

**Which products and versions are affected?** StratonWebDesigners HireFlow <= 1.2.

**Is there a fix for CVE-2026-45336?** A patch was published on 2026-05-08: Version 1.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45336 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45336?** Check whether you run StratonWebDesigners HireFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Use of Hard-coded Credentials (CWE-798) within the HireFlow interview management system. The application's 'app.py' file assigns a static string ('supersecret123') to the Flask secret_key, which is used by the itsdangerous library to cryptographically sign session cookies. Because this key is publicly available in the source code, a remote, unauthenticated attacker can locally sign a crafted session cookie containing 'role=admin' and arbitrary 'user_id' values. When presented to the server, the application validates the signature against the hard-coded key and grants the attacker full administrative privileges. This issue is resolved in version 1.3 by removing the hard-coded key.

## Affected products

- StratonWebDesigners HireFlow <= 1.2

## Timeline

- 2026-05-08: patched: Version 1.3 released
- 2026-05-13: advisory: GitHub Security Advisory GHSA-x53g-jr84-jrv5 published
- 2026-07-16: disclosed: CVE-2026-45336 published to NVD

## References

- [https://github.com/StratonWebDesigners/HireFlow/releases/tag/v1.3](https://github.com/StratonWebDesigners/HireFlow/releases/tag/v1.3)
- [https://github.com/StratonWebDesigners/HireFlow/security/advisories/GHSA-x53g-jr84-jrv5](https://github.com/StratonWebDesigners/HireFlow/security/advisories/GHSA-x53g-jr84-jrv5)

## Related threats

- [StratonWebDesigners HireFlow stored XSS in candidate_detail.html](https://junglewise.ai/threats/cve-2026-38569-stratonwebdesigners-hireflow-stored-xss-in-candidate-detail-html)
- [StratonWebDesigners HireFlow IDOR in candidate and interview endpoints](https://junglewise.ai/threats/cve-2026-38568-stratonwebdesigners-hireflow-idor-in-candidate-and-interview)
- [StratonWebDesigners HireFlow SQL injection in login and search endpoints](https://junglewise.ai/threats/cve-2026-38567-stratonwebdesigners-hireflow-sql-injection-in-login-and-search)
- [StratonWebDesigners HireFlow CSRF in multiple endpoints](https://junglewise.ai/threats/cve-2026-38566-stratonwebdesigners-hireflow-csrf-in-multiple-endpoints)