High severity · published Aug 4, 2026
CVE-2026-14838
Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
HUMANIST Digital Human Resources · Bilin Software and Informatics Consultancy Inc.
26.0 before 26.1 · source: vendor
Affected product
HD
HUMANIST Digital Human Resources
Bilin Software and Informatics Consultancy Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14838
siberguvenlik.gov.tr
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0737
More from HUMANIST Digital Human Resources
9.8
CVE-2026-14175
Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources
9.8
CVE-2026-15721
Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources
9.1
CVE-2026-14804
Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources
6.5
CVE-2026-14465
Session Fixation in Bilin Software's HUMANIST Digital Human Resources
6.5
CVE-2026-14194
Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources