HR Platform Bypasses Authentication, AI Tools Ship Default Admin Tokens

On 11 October 2026, three critical vulnerabilities were published to the National Vulnerability Database, exposing fundamental authentication failures in HR and AI platforms used by UK small businesses. CVE-2026-108707 (CVSS 9.8) allows unauthenticated attackers to access all HR data in Wukong HRM by simply omitting the authentication token header, exposing payslips, salary history, and employee records without any credential check. The vendor was contacted and did not respond. Two further vulnerabilities (CVE-2026-108753, CVSS 9.4, and CVE-2026-108860, CVSS 9.1) affect AI chat platforms Agnaistic and BotSharp, both shipping with hard-coded admin credentials and publicly known JWT signing secrets that allow attackers to forge administrative tokens. For UK businesses, these failures carry direct GDPR obligations: salary and employment data are personal data, and authentication bypass vulnerabilities undermine the requirement for appropriate technical measures under UK GDPR. This episode provides specific audit steps for small business owners, including how to check the NVD for vendor disclosures, how to query IT providers about hard-coded credentials, and why vendor responsiveness to security research is a procurement signal worth evaluating before deployment.

Chapters

• Intro Corrine introduces the episode with a question: when did someone last check whether your HR software actually requires a password? Today’s briefing covers an HR platform that doesn’t enforce authentication at all.
• The HR System That Skips the Password Check Entirely CVE-2026-108707 (CVSS 9.8) allows unauthenticated attackers to access all HR API endpoints in Wukong HRM by omitting the authentication token header entirely. The platform exposes payslips, salary history, and employee personal data without credential checks. The vendor was contacted and did not respond. UK GDPR obligations for salary and employment data apply, and ICO enforcement history shows significant fines for failure to implement appropriate security measures.
• CTA Corrine asks listeners to follow the show, leave a rating or review, and share the episode with other small business owners who would benefit from the briefing.
• The AI Platforms That Hand Out Admin Tokens CVE-2026-108753 (CVSS 9.4) affects Agnaistic through version 1.0.555, with a fixed admin password and public JWT secret in Docker Compose configuration. CVE-2026-108860 (CVSS 9.1) affects BotSharp through version 5.2.0, with HMAC secrets and JWT signing values committed in application settings files. Both allow unauthenticated attackers to forge admin tokens and impersonate users. AI platforms are being adopted rapidly by small businesses, often without audit of default credentials or hard-coded secrets.
• Why Vendors Who Don’t Respond Are a Specific Problem CVE-2026-108707 and CVE-2026-108576 (CVSS 10.0) both note that vendors were contacted early and did not respond. Vendor responsiveness to security research is a procurement signal: it demonstrates whether they prioritise security and whether they will patch vulnerabilities when disclosed. For UK small businesses, this is a question worth asking before software is deployed.
• The Broader Pattern: Hard-Coded Credentials Hard-coded credentials are a well-documented, entirely preventable vulnerability class covered by OWASP Top Ten and NCSC guidance. They persist because they are convenient during development and because vendors do not face direct consequences. For UK businesses, running software with known authentication bypass vulnerabilities undermines the requirement for appropriate technical measures under UK GDPR. Cyber Essentials certification requires patching high-severity vulnerabilities within fourteen days, and auditing vendor disclosures is both a certification requirement and a competitive differentiator.
• Outro Corrine provides specific next steps: produce a list of all applications running in your business, search each in the National Vulnerability Database, and escalate any critical or high-severity results from the last ninety days. For self-hosted platforms, ask IT contacts whether default passwords have been changed and whether hard-coded credentials or JWT secrets have been identified. For HR platforms, contact the vendor and ask for their response to authentication bypass vulnerabilities in their API layer.

Links

• https://nvd.nist.gov/vuln/detail/CVE-2026-108707
• https://nvd.nist.gov/vuln/detail/CVE-2026-108753
• https://nvd.nist.gov/vuln/detail/CVE-2026-108860
• https://nvd.nist.gov/vuln/detail/CVE-2026-108576
• https://www.ncsc.gov.uk/collection/developers-collection
• https://owasp.org/www-project-top-ten/
• https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/
• https://www.ncsc.gov.uk/cyberessentials/overview