Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (CVE-2026-90983)
Description
Hayat Mobile versions from 3.3.0 up to but not including 3.4.0 contain a client-side authentication vulnerability that allows authentication bypass. This vulnerability is identified as CVE-2026-90983 and has a high severity rating with a CVSS score of 8.2. The flaw enables attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the application.
CVSS v3.1
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90983 describes a client-side authentication vulnerability in Hayat Mobile (Hayat Health Facilities Inc.) affecting versions from 3.3.0 before 3.4.0. The vulnerability allows an attacker to bypass authentication controls implemented on the client side, which can lead to unauthorized access. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected Hayat Mobile application. This can lead to exposure of sensitive information (high confidentiality impact) and limited integrity impact. There is no impact on availability. The vulnerability poses a significant risk to the confidentiality of user data within the affected versions.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to affected versions and monitor for updates from Hayat Health Facilities Inc.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ww6f-xwjx-7hgg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90983"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac96e562cdf04f65689a7eb
Added to database: 10/09/2026, 22:44:38 UTC
Last enriched: 10/09/2026, 22:51:11 UTC
Last updated: 10/10/2026, 04:48:07 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.