This vulnerability in e-Sushrut HMIS arises from improper authentication (CWE-287) where the authentication decision depends on client-side response parameters. An attacker who intercepts and alters these parameters can bypass authentication controls remotely, gaining unauthorized access to user accounts. The CVSS 4.0 base score is 8.8 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality. No official fix or patch has been published, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation enables remote attackers to bypass authentication and access user accounts without credentials, potentially exposing sensitive hospital management data. The high CVSS score reflects significant confidentiality impact and ease of exploitation. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected system and monitor for suspicious activity related to authentication bypass attempts. Avoid relying on client-side authentication logic in the interim.