This vulnerability in KiviCare allows an attacker to bypass authentication by exploiting the password recovery mechanism through an alternate path or channel. The issue affects all versions up to 4.3.0. The CVSS 3.1 score of 8.2 reflects a network attack vector with low attack complexity, no privileges required, and no user interaction needed. The impact is high on confidentiality, with limited integrity impact and no availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated attacker to gain unauthorized access to user accounts by bypassing authentication via the password recovery process. This compromises confidentiality of sensitive data within the KiviCare system. Integrity impact is limited, and availability is not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the password recovery functionality or implementing additional monitoring around authentication attempts. Avoid relying solely on the password recovery feature for authentication security.