CVE-2026-8990 describes an authentication bypass vulnerability in the Kidsview mobile app version 4.0.1. A user with physical access to the smartphone can exploit the app's push notification handling to bypass authentication controls and gain full access to the account. This vulnerability is linked to improper authentication checks (CWE-288) and exposure of sensitive information (CWE-359). The issue was resolved by the vendor in version 4.4.3. The CVSS 4.0 vector indicates the attack requires physical access (AV:P), low attack complexity (AC:L), and no privileges or user interaction, with high impact on confidentiality and integrity. No cloud service implications are noted.

Successful exploitation allows an attacker with physical access to the device to bypass authentication and fully access the victim's Kidsview account, potentially exposing private information and allowing unauthorized control. The impact affects confidentiality and integrity of the user's data within the app. There are no reports of active exploitation in the wild.

Users and administrators should upgrade the Kidsview mobile application to version 4.4.3 or later, where this vulnerability has been fixed. Since this is not a cloud service, remediation requires updating the client app on affected devices. No other mitigation or temporary workaround is indicated by the vendor or advisory.