This vulnerability in HUMANIST Digital Human Resources involves insufficient session expiration, which permits reuse of session IDs (session replay). This can allow an attacker to reuse a valid session token to impersonate a legitimate user. The affected versions are from 26.0 before 26.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker who successfully exploits this vulnerability can reuse valid session IDs to gain unauthorized access to user sessions, potentially exposing sensitive information. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor vendor communications for updates and consider additional session management controls until a fix is available.