CVE-2026-90983 OTP Code Exposure in Hayat Hospital's Hayat Mobile
Attackers can bypass authentication in the Hayat Mobile app due to client-side OTP exposure, potentially taking over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90983?
CVE-2026-90983 is a high-severity authentication bypass vulnerability in Hayat Mobile, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.
This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.
Weakness: CWE-603
Which versions are affected by CVE-2026-90983?
How do I fix CVE-2026-90983?
No fix has been published for CVE-2026-90983 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-90983 being exploited?
There is no known exploitation of CVE-2026-90983 in the wild and no public exploit code.
Sources
Also known as GHSA-ww6f-xwjx-7hgg.