PT-2026-3914 · Horilla · Horilla

Whoisshuvam · Publicado 2026-01-22 · Atualizado 2026-01-27 · CVE-2026-24038

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Horilla version 1.4.0

Description Horilla, a Human Resource Management System (HRMS), contains a flaw in its two-factor authentication implementation. Specifically, the OTP handling logic has a flawed equality check. When an OTP expires, the server returns None. An attacker can bypass two-factor authentication by omitting the otp field from their POST request, causing the comparison user otp == otp to pass, even without a valid OTP. Targeting administrative accounts could lead to compromise of sensitive HR data and manipulation of employee records. The vulnerable parameter is otp.

Recommendations Update to version 1.5.0 or later.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-24038

GHSA-HQPV-FF5V-3HWF

Produtos afetados

Horilla

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24038.json · Exploit
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Nota
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-hqpv-ff5v-3hwf · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014196243598110817 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24038 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24038 · Aviso do Fabricante
• https://twitter.com/lsof/status/2014399093829689605 · Publicação no Twitter
• https://twitter.com/cracbot/status/2016103984789164127 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014220460720832836 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2014203023636267464 · Publicação no Twitter
• https://t.me/CVEtracker/42741 · Publicação no Telegram