This vulnerability (CVE-2025-9342) in AHE Mobile versions 1.9.7 up to but not including 1.9.9 allows an attacker with some level of privileges to bypass authorization controls by manipulating user-controlled keys. This is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The attack vector is network-based with low attack complexity and no user interaction required. The vulnerability impacts confidentiality but not integrity or availability.

Successful exploitation could allow an attacker with limited privileges to access or abuse functionalities beyond their authorization level, potentially exposing sensitive information. The CVSS score of 6.5 reflects a medium severity impact primarily on confidentiality. There is no indication of impact on system integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users of affected versions should monitor Anadolu Hayat Emeklilik Inc. communications for updates. Until a fix is available, restricting access to trusted users and minimizing privilege levels may reduce risk.