Use of a hard‑coded password, 'changeme', in the employee onboarding component allows an unauthenticated remote attacker to authenticate as any employee whose email address is known. The onboarding form does not provide a password field, and the employee save controller falls back to the literal password when no password is supplied. The flaw is a classic example of hard‑coded credentials, identified by CWE‑798, and results in complete impersonation of employees without any initial authentication.

Roskus Prospero Flow CRM before version 5.15.9 is vulnerable. Any installation of the product without the 5.15.9 or later patch is affected. The issue is specific to the human resources component that handles employee onboarding.

The CVSS score of 9.3 marks this flaw as critical, and although no EPSS score is reported, the lack of a required authentication step and the availability of a simple default password make exploitation readily feasible. The vulnerability is not listed in CISA KEV, but organizations using the default onboarding flow can immediately impersonate employees. Theory suggests that the attacker can trigger the flaw by submitting a user registration request to the standard onboarding endpoint with only the email field.