CVE-2026-90983
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.
CVSS
8.2
High
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Published: Oct 9, 2026 · Last modified: Oct 9, 2026 · CWE-603
0.3%EPSS · 30 days0.3%
2026-10-102026-10-23
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-30964.7 MED20.2%
——6The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigating to external destinations.
This vulnerability could allow an attacker to manipulate the original trusted application window after a user clicks a malicious external link. This manipulation can lead to users being redirected to phishing pages, enabling credential theft, or facilitating other unauthorized actions within the context of the trusted site.35dCVE-2026-663057.1 HIG43.8%
——13Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.37dCVE-2026-769457.5 HIG42.2%
——13The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to gain unauthorized access to
administrative functionality.53dCVE-2026-711879.8 CRI55.5%
——17The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.53dCVE-2026-88304.3 MED37.2%
——11A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.92dCVE-2026-40551—8.4%
——3Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user.
The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.23d