This vulnerability, identified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), affects KiviCare versions up to 4.5.1. It enables unauthenticated attackers to bypass authentication mechanisms and access sensitive data. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker can gain unauthorized access to sensitive data in KiviCare without authentication, potentially leading to data confidentiality breaches. There is no reported impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to KiviCare installations and monitor for unusual access patterns related to authentication bypass attempts.