HR Platform Bypasses Authentication, AI Tools Ship Default Admin Tokens
HR Platform Bypasses Authentication, AI Tools Ship Default Admin Tokens
On 11 October 2026, three critical vulnerabilities were published to the National Vulnerability Database, exposing fundamental authentication failures in HR and AI platforms used by UK small businesses. CVE-2026-108707 (CVSS 9.8) allows unauthenticated attackers to access all HR data in Wukong HRM by simply omitting the authentication token header, exposing payslips, salary history, and employee records without any credential check. The vendor was contacted and did not respond. Two further vulnerabilities…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.