CVE-2026-24038

Katalog CVE

CVSS 8.1 · High EPSS 0,49%

Kerentanan Improper Authentication pada horilla. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-hqpv-ff5v-3hwf exploit · advisory vendor
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 release notes