High · 7.4 CVE-2026-14838 EUVD-2026-52652GHSA-chm9-7crh-67fc

Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources

Published Aug 4, 2026 · Updated Aug 4, 2026 · Assigned by TR-CERT

Vendor: Bilin Software and Informatics Consultancy Product: HUMANIST Digital Human Resources

Description

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.

This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

Affected products

Vendor	Product	Affected	Fixed
Bilin Software and Informatics Consultancy	HUMANIST Digital Human Resources	26.0 – < 26.1	26.1

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0737 government-resource