HireFlow contains a hard‑coded Flask secret_key in app.py for versions 1.2 and earlier, which is used to sign session cookies. An attacker who can obtain this public source value can forge a session cookie with role=admin and a user_id payload, thereby bypassing authentication and gaining full administrative access.

StratonWebDesigners HireFlow 1.2 and earlier are affected. Version 1.3 and later contain a fix for this issue.

The vulnerability carries a CVSS score of 10, indicating critical severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability, and the issue is not listed in CISA KEV. The likely attack vector is through the web application; the attacker only needs to know the hard‑coded secret, which can be obtained from the publicly available source code. By crafting a forged session cookie, the attacker can impersonate an administrator and manipulate hiring data without any authentication.