#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL WUKONG HRM AUTHENTICATION BYPASS EXPOSES EMPLOYEE AND PAYROLL DATA October 10, 2026 DISCLOSED BY: VulnCheck PRODUCT: WuKongOpenSource Wukong_HRM CVE: CVE-2026-108707 SEVERITY: Critical — CVSS 9.3 (v4) AFFECTED VERSIONS: Source revisions through commit 186115e. No verified fixed release identified. IMPACT: Unauthenticated attackers can bypass API authentication by omitting the AUTH-TOKEN header. Affected endpoints may expose employee records, salary history, payslips, and attachments. Unauthorized modification or deletion of HR records is also possible. EXPLOITATION STATUS: CONFIRMED AUTHENTICATION VULNERABILITY. Public researcher PoCs are available. Active malicious exploitation remains unverified. EXPOSURE: Network access to affected HRM API endpoints. Forensic triage: Review API requests missing AUTH-TOKEN, particularly unexpected successful responses. Investigate suspicious employee exports, attachment downloads, payroll access, and unauthorized HR record changes. URGENT ACTION: Restrict HRM API exposure immediately. Enforce server-side authentication and authorization on every protected endpoint. Audit historical access and apply a verified security fix when available. SOURCE: https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect CONFIDENCE: HIGH — VulnCheck CNA advisory, publicly inspectable vulnerable source code, and researcher PoCs. Real-world exploitation is unconfirmed. #CyberSecurity #ThreatIntel #AuthenticationBypass #DataSecurity #VulnerabilityResearch