CVE-2026-38566

The interview management platform HireFlow v1.2 is vulnerable to Cross-Site Request Forgery (CSRF) because it lacks CSRF token validation on state-changing POST endpoints and fails to configure the SESSION_COOKIE_SAMESITE attribute. An attacker can trick an authenticated user into visiting a mali...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...