Authentication Bypass Vulnerability in Wukong HRM by WuKong Open Source
CVE-2026-108707

9.3CRITICAL

Key Information:

Vendor

Wukongopensource

Status
Wukong Hrm
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108707?

Wukong HRM is susceptible to an authentication bypass vulnerability in its ParamAspect component, allowing unauthenticated malicious actors to access all HRM API endpoints by omitting the required AUTH-TOKEN header. This flaw can lead to unauthorized access to sensitive HR data, including employee payslips, salary histories, and personal information. Attackers can exploit this vulnerability to manipulate, download, or delete critical company-wide HR records, significantly impacting organizational confidentiality and integrity.

Affected Version(s)

Wukong_HRM 0 <= 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108707 - Proof of Concept

CVE-2026-108707 - Proof of Concept

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.