CVE-2026-14838: Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
Published Aug 4, 2026
·Updated
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
Affected Software
1 affected component
Bilin Software and Informatics Consultancy Inc./HUMANIST Digital Human Resources>=26.0<26.1
Event History
Aug 4, 2026
CVE Published
via MITRE·08:42 AM
Data Sourced
via MITRE·08:42 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-14838?
The severity of CVE-2026-14838 is rated as high, with a score of 7.4.
2
How do I fix CVE-2026-14838?
To fix CVE-2026-14838, upgrade to HUMANIST Digital Human Resources version 26.1 or later.
3
What systems are affected by CVE-2026-14838?
CVE-2026-14838 affects HUMANIST Digital Human Resources versions prior to 26.1.
4
What type of vulnerability is CVE-2026-14838?
CVE-2026-14838 is a session token exposure vulnerability that can lead to account takeover.
5
What are the potential impact and risks of CVE-2026-14838?
The potential impact of CVE-2026-14838 includes session hijacking, which can result in unauthorized access to user accounts.