This vulnerability (CVE-2026-14465) in HUMANIST Digital Human Resources version 26.0 involves insufficient session expiration, categorized under CWE-613. It allows an attacker to reuse session IDs, potentially enabling session replay attacks. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating that the attack can be performed remotely with low complexity and no privileges, requiring user interaction, and results in high confidentiality impact without affecting integrity or availability. No official fix or patch has been published by the vendor as of the data provided.

The vulnerability allows reuse of session IDs due to insufficient session expiration, which can lead to unauthorized access to user sessions (session replay). This compromises confidentiality by potentially exposing sensitive user data. There is no impact on integrity or availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing compensating controls such as reducing session timeout durations, monitoring for unusual session activity, and educating users about the risks of session reuse. Avoid relying solely on session IDs for authentication and consider additional verification mechanisms.