CVE-2026-45336 affects StratonWebDesigners' HireFlow, a web-based interview management system. In versions 1.2 and earlier, the application uses a hard-coded Flask secret_key in app.py to sign session cookies. Because this key is publicly known, attackers can create forged cookies with arbitrary role and user_id values, including administrative privileges, enabling authentication bypass. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). The advisory indicates that version 1.3 fixes this issue.

An attacker can bypass authentication by forging session cookies signed with the known hard-coded secret_key, gaining unauthorized administrative access. This compromises confidentiality and integrity of the system and allows unauthorized actions within HireFlow. The CVSS score is 10.0 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and low impact on availability.

Upgrade HireFlow to version 1.3 or later, where the hard-coded secret_key vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgraded, systems remain vulnerable to authentication bypass via forged cookies.