by Kastro
Paper/Archive/CVE-2026-19871

CVE-2026-19871

Roskus Prospero Flow CRM — Use of hard-coded credentials in Prospero Flow CRM employee onboarding

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 44.8.448 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

Affected

ProductAffectedFixed inSource
Prospero Flow CRM< 5.15.95.15.9CNA

Scores by source

Secur0 (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/Roskus/prospero-flow-crm/commit/5cc01ed958db4ad0a026a8daa1c6a8bb98a43e66writeupsecur0.com/en/cna/cve-list/cve-2026-19871-hardcoded-credentials-in-prospero-flow-crm-employee-onboarding