PT-2026-3914 · Horilla · Horilla

Whoisshuvam · Published 2026-01-22 · Updated 2026-01-27 · CVE-2026-24038

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Horilla version 1.4.0

Description Horilla, a Human Resource Management System (HRMS), contains a flaw in its two-factor authentication implementation. Specifically, the OTP handling logic has a flawed equality check. When an OTP expires, the server returns None. An attacker can bypass two-factor authentication by omitting the otp field from their POST request, causing the comparison user otp == otp to pass, even without a valid OTP. Targeting administrative accounts could lead to compromise of sensitive HR data and manipulation of employee records. The vulnerable parameter is otp.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-24038

GHSA-HQPV-FF5V-3HWF

Affected Products

Horilla

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24038.json · Exploit
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-hqpv-ff5v-3hwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24038 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24038 · Vendor Advisory
• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0 · Note
• https://twitter.com/CVEnew/status/2014196243598110817 · Twitter Post
• https://twitter.com/lsof/status/2014399093829689605 · Twitter Post
• https://twitter.com/cracbot/status/2016103984789164127 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014220460720832836 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014203023636267464 · Twitter Post
• https://t.me/CVEtracker/42741 · Telegram Post