A critical authentication bypass vulnerability in Horilla HRMS versions 1.4.0 through 1.4.x allows attackers to circumvent two-factor authentication, posing a severe risk to sensitive HR data.

The application contains an improper authentication flaw (CWE-287) in its OTP verification logic. By omitting the OTP parameter in a POST request, an authenticated attacker can trigger a comparison error that results in a successful bypass of two-factor authentication.

The ability to bypass two-factor authentication provides an unauthorized attacker with access to administrative HR accounts. This may result in the exfiltration of sensitive employee data, the unauthorized modification of payroll or personnel records, and potential escalation to full system compromise. Given the CVSS score of 8.1, this represents a high-severity risk to organizational data integrity and confidentiality.

Immediate Action: Upgrade to Horilla HRMS version 1.5.0 or higher immediately to resolve the flawed equality check in the OTP handling logic.

Proactive Monitoring: Review application access logs for repeated authentication attempts where the OTP parameter is missing or malformed.

Compensating Controls: Implement strict network access controls to limit exposure of the HRMS administrative interface, and monitor for anomalous session patterns initiated from unusual IP addresses.

Public Exploit Available: No (exploit_available unknown)

This vulnerability presents a significant risk to the security of human resources infrastructure. Organizations currently utilizing Horilla HRMS version 1.4.0 should prioritize the update to version 1.5.0. Failure to patch allows for trivial authentication bypass, potentially granting attackers full control over sensitive personnel systems.