Skip to content
Secur0
Solutions
View all AI Agent Security New Protect your AI agents Vulnerability Disclosure Secure reporting channel Penetration Testing Expert manual audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment Live Hacking Live real-time pentesting For company teams Train your technical team For educational centers Bring hacking to the classroom For hackers Learn and get certified Competitions / CTFs Put your skills to the test
Customer Stories
View all Penetration Testing Manual pentesting VDP Secure reporting channel Pentest In-depth audits Crowdsourced Pentest Thousands of hackers, one goal Bug Bounty Success-based payment
Resources
About Secur0 Get to know us Jobs Join the team Media Kit Brand resources Contact Talk to us Newsletter Industry news Blog Articles and guides Partners Join the partner network We are a CNA We are a CVE Numbering Authority
Are you a hacker?
Request a demo Log in
Español English
Back to list
CVE-2026-1987 ·
Critical · August 14, 2026

Use of hard-coded credentials in Prospero Flow CRM allows access to employee accounts created through the onboarding flow

S0
Secur0 CNA
CVE-2026-1987

Description

Use of Hard-coded Credentials (CWE-798) in EmployeeSaveController (app/Http/Controllers/Rrhh/Employee/EmployeeSaveController.php), exposed at POST /rrhh/employee/save, in Prospero Flow CRM 5.14.3, which allows an unauthenticated remote attacker to authenticate as any employee onboarded through the standard human resources flow, knowing only their email address, because the save() method assigned the password with bcrypt($request->input('password', 'changeme')), taking the literal string changeme as its default value, while the view shared by the create and edit forms (resources/views/rrhh/employee/_form.blade.php) contained no password field and the controller's validation rules did not cover one, so the only path the product offers invariably created the account with that credential. The resulting record is the same User model used for authentication throughout the rest of the application, making it a fully functional login account, and the application did not disclose the assigned credential, send any message to the employee, or force a change on first login. This results in full access, using the employee's own credentials, to the account and to the data and actions it can reach.

Vulnerability type (CWE)

CWE-798: Use of Hard-coded Credentials

Affected versions

Prospero Flow CRM before 5.15.9 (fixed in 5.15.9 by commit 5cc01ed9, dated 2026-07-27). The sink was introduced along with the human resources module in commit 04d1afd7 (2026-07-09), at version 5.10.0, and was present in the v5.14.0 tag, so a tagged release did ship in a vulnerable state. Versions are read from the APP_VERSION constant in version.php. Default status: unaffected.

Score (CVSS 4.0)

Critical (9.3)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Solution

Upgrade to version 5.15.9 or higher. The fix is not included in any tagged release: the repository's latest tag is v5.14.0, which predates it. Accounts created by earlier versions keep the assigned credential until it is changed, so resetting the password of every employee onboarded through the affected flow is recommended.

Patch

Commit 5cc01ed9

Credits

  • Adrián García López - finder
  • Darío Rivas Quero - analyst
  • Xoán M. Otero Jorge - analyst
  • Secur0 CNA - coordinator
  • Gustavo Novaro - remediation developer Discovery source: External Official record: CVE-2026-19871