CVE-2026-45336 affects StratonWebDesigners' HireFlow, a web-based interview management system. In versions 1.2 and earlier, the application uses a hard-coded Flask secret_key in app.py to sign session cookies. Because this key is publicly known, attackers can create forged session cookies with arbitrary role and user_id values, including administrative privileges, enabling authentication bypass. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). The issue is fixed in version 1.3.

An attacker can bypass authentication by forging session cookies signed with the hard-coded secret_key, gaining unauthorized administrative access. This leads to complete compromise of the application’s authentication mechanism, potentially exposing sensitive candidate and hiring data and allowing unauthorized actions within the system. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high confidentiality, integrity, and low availability impacts.

Upgrade HireFlow to version 1.3 or later, where the hard-coded secret_key vulnerability is fixed. Until the upgrade is applied, restrict access to the affected versions and avoid deployment in untrusted environments. Patch status is not explicitly stated as 'official-fix' in the advisory, but version 1.3 is listed as fixed, so applying this version is the recommended remediation.