CVE-2026-90983

HighCVSS 8.2/10Last modified Oct 9, 2026

Description

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.

This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-603

Affected software

VendorProductVersions
Hayat Health Facilities Inc. (Hayat Hospital)Hayat Mobile>= 3.3.0, < 3.4.0

References

Timeline

Published
Oct 9, 2026
Last modified
Oct 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-909845.8The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer peCVE-2026-909855.3The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning produCVE-2026-909867.1Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions.CVE-2026-909875.3The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a cliCVE-2026-909885.3The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allCVE-2026-909894.3The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any CVE-2026-90997.7A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an autCVE-2026-909905.3Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticatCVE-2026-909916.5IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resourceCVE-2026-909926.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field inCVE-2026-90993XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to uCVE-2026-909944.0A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data()
CVE-2026-90983: High severity, CVSS 8.2 | Vulnix