Use of Hard-coded Credentials in Roskus Prospero Flow CRM
CVE-2026-19871

9.3CRITICAL

Key Information:

Vendor

Roskus

Status
Prospero Flow Crm
Vendor
CVE Published:
14 August 2026

What is CVE-2026-19871?

The human resources component of Roskus Prospero Flow CRM prior to version 5.15.9 is vulnerable due to the presence of hard-coded credentials. This flaw enables unauthenticated remote attackers to bypass authentication processes and gain access as any employee once they provide a valid email address. The onboarding mechanism lacks a password field, defaulting to the insecure literal password 'changeme', thereby posing significant risks to user accounts and sensitive information.

Affected Version(s)

Prospero Flow CRM 0 < 5.15.9

References

https://github.com/Roskus/prospero-flow-crm/commit/5cc01e...
patch
https://secur0.com/en/cna/cve-list/cve-2026-19871-hardcod...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrián García López
DarĂ­o Rivas Quero
Xoán M. Otero Jorge
Secur0 CNA
Gustavo Novaro
.