This vulnerability in e-Sushrut HMIS arises from the exposure of one-time passwords (OTPs) in plaintext within API responses. Because these OTPs are not encrypted during transmission, a remote attacker capable of intercepting network traffic could obtain valid OTPs. This would enable the attacker to impersonate legitimate users and gain unauthorized access to their accounts. The CVSS v4.0 base score is 8.8, reflecting high severity due to network attack vector, no required privileges or user interaction, and high confidentiality impact. The vulnerability is classified under CWE-319 (Cleartext Transmission of Sensitive Information). No patch or official remediation level has been published by the vendor as of now.

Successful exploitation allows an attacker to intercept OTPs transmitted in plaintext, enabling user impersonation and unauthorized access to user accounts within the e-Sushrut HMIS. This compromises confidentiality and authentication integrity of the system. There is no indication of privilege escalation or impact beyond user account compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, minimizing exposure by securing network communications (e.g., using VPNs or secure channels) may reduce risk, but no vendor-endorsed mitigations are documented.