CVE-2026-90983: CWE-603 Use of Client-Side authentication in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile

The vulnerability identified as CVE-2026-90983 affects Hayat Mobile from version 3.3.0 before 3.4.0. It is classified as CWE-603 (Use of Client-Side Authentication), which means authentication is improperly implemented on the client side rather than securely on the server side. This flaw allows an attacker to bypass authentication mechanisms, potentially gaining unauthorized access to the application. The CVSS v3.1 base score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls in Hayat Mobile, potentially gaining unauthorized access to sensitive information. The confidentiality impact is high, meaning sensitive data could be exposed. Integrity impact is low, and availability is not affected. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, avoid using affected versions or restrict access to trusted users if possible.