CVE-2026-14838
Received Received - Intake

Session Hijacking via GET Request in HUMANIST Digital Human Resources

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-14838
EUVD
EUVD-2026-52652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bilin_software_and_informatics_consultancy_inc humanist_digital_human_resources From 26.0 (inc) to 26.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves using a GET request method with sensitive query strings in Bilin Software's HUMANIST Digital Human Resources software. This allows attackers to hijack user sessions by capturing or manipulating the query strings in URLs.

Detection Guidance

Detecting this vulnerability requires checking if sensitive data like session tokens are passed in URLs via GET requests. Inspect web server logs for URLs containing session identifiers or sensitive parameters. Use tools like Wireshark or tcpdump to capture HTTP traffic and look for GET requests with sensitive query strings. Check application code for hardcoded or improperly handled session tokens in URLs.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user sessions, potentially stealing sensitive data like personal information or credentials. This could lead to identity theft, data breaches, or unauthorized system access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data exposure. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update HUMANIST Digital Human Resources to version 26.1 or later to address the issue. Ensure sensitive data, including session tokens, are not passed in URLs. Configure web servers to reject GET requests with sensitive query parameters. Implement secure coding practices to avoid exposing session data in logs or browser history.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart