Vulnerability · Published Aug 14, 2026 · Assigned by Secur0

CVE-2026-19871Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Critical 9.3

In plain English

A critical-severity hard-coded credentials in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

Affected products (as reported)

Vendor	Product	Versions
Roskus	Prospero Flow CRM	0 – before 5.15.9

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References