CVE-2026-19871: Use of hard-coded credentials in Prospero Flow CRM employee onboarding
Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.9 - Operational
Reset the password of every employee onboarded through the affected Roskus Prospero Flow CRM onboarding standard flow.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19871?
CVE-2026-19871 has a risk score of 84, indicating a high severity vulnerability.
How do I fix CVE-2026-19871?
To fix CVE-2026-19871, update Roskus Prospero Flow CRM to version 5.15.9 or later.
What type of attack is associated with CVE-2026-19871?
CVE-2026-19871 allows unauthenticated remote attackers to authenticate as any employee using hard-coded credentials.
Who is affected by CVE-2026-19871?
Organizations using Roskus Prospero Flow CRM versions prior to 5.15.9 are affected by CVE-2026-19871.
What component of Roskus Prospero Flow CRM is vulnerable in CVE-2026-19871?
The human resources component related to employee onboarding is vulnerable in CVE-2026-19871.