A critical authentication bypass vulnerability, tracked as CVE-2026-45336, affects HireFlow interview management systems through version 1.2. The vulnerability arises from a hard-coded secret_key value in app.py, used to sign Flask session cookies. Attackers with knowledge of the public source code can generate forged cookies containing arbitrary role=admin and user_id parameters, directly gaining administrative access without authentication. This flaw allows full system compromise, including candidate data manipulation, interview scheduling control, and access to sensitive HR workflows. All deployments of HireFlow 1.2 and earlier versions are affected. The CVSS score of 10.0 reflects the ease of remote exploitation and severe impact. Immediate mitigation requires upgrading to HireFlow 1.3, where the secret key implementation has been remediated. Organizations should prioritize patching to prevent unauthorized access, data breaches, and operational disruption. No temporary workarounds are available for versions prior to 1.3. Affected users are advised to monitor access logs for suspicious administrative activity and implement network-level restrictions as a secondary defense measure.