CVE-2026-24038 — HIGH (8.1)

Vulnerability Description

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Horilla	Horilla	1.4.0

Related Weaknesses (CWE)

CWE-287

References

https://github.com/horilla-opensource/horilla/releases/tag/1.5.0Release Notes
https://github.com/horilla-opensource/horilla/security/advisories/GHSA-hqpv-ff5vExploitVendor Advisory

FAQ

What is CVE-2026-24038?

CVE-2026-24038 is a vulnerability with a CVSS score of 8.1 (HIGH). Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server re...

How severe is CVE-2026-24038?

CVE-2026-24038 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-24038?

Check the references section above for vendor advisories and patch information. Affected products include: Horilla Horilla.