CVE-2026-24038

Horilla is a free and open source Human Resource Management System (HRMS). In version 1.4.0, the OTP handling logic has a flawed equality check that can be bypassed. When an OTP expires, the server returns None, and if an attacker omits the otp field from their POST request, the user-supplied OTP is also None, causing the comparison user_otp == otp to pass. This allows an attacker to bypass two-factor authentication entirely without ever providing a valid OTP. If administrative accounts are targeted, it could lead to compromise of sensitive HR data, manipulation of employee records, and further system-wide abuse. This issue has been fixed in version 1.5.0.

• CWE-287

• https://github.com/horilla-opensource/horilla/releases/tag/1.5.0Release Notes
• https://github.com/horilla-opensource/horilla/security/advisories/GHSA-hqpv-ff5v-3hwfExploit, Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24032A vulnerability has been identified in SINEC NMS (All versio…7.3
• CVE-2026-24033Inconsistent Interpretation of HTTP Requests ('HTTP Request/…5.3
• CVE-2026-24034Horilla is a free and open source Human Resource Management …5.4
• CVE-2026-24035Horilla is a free and open source Human Resource Management …4.3
• CVE-2026-24036Horilla is a free and open source Human Resource Management …5.3
• CVE-2026-24037Horilla is a free and open source Human Resource Management …5.4
• CVE-2026-24039Horilla is a free and open source Human Resource Management …4.3
• CVE-2026-2404CWE-116 Improper Encoding or Escaping of Output vulnerabilit…5.3
• CVE-2026-24040jsPDF is a library to generate PDFs in JavaScript. Prior to …4.8
• CVE-2026-24042Appsmith is a platform to build admin panels, internal tools…9.8
• CVE-2026-24043jsPDF is a library to generate PDFs in JavaScript. Prior to …5.4
• CVE-2026-24044Element Server Suite Community Edition (ESS Community) deplo…9.2