https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:13:38.276020+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-24038 CVE-2026-24038 — Horilla HR has 2FA Bypass through its OTP Handling Logic 2026-10-07T20:13:38.294210+00:00

Affected: horilla-opensource horilla

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.