CVE-2026-14838
Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
- State
- Published
- Severity
- 7.4 High
- Published
- Aug 4, 2026
- Updated
- Aug 4, 2026
- Reserved
- Jul 6, 2026
Description
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | TR-CERT |
Weaknesses
- CWE-598 Use of GET request method with sensitive query strings
Affected Products
| Product | Versions |
|---|---|
HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy Inc. |
|
References
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0737government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.