Which versions of PHP are affected by CVE-2026-4617?

An authentication bypass vulnerability in the Patients Waiting Area Queue Management System allows attackers to access patient data and system functions without credentials.

Is there a public PoC exploit available for CVE-2026-4617?

Yes, a public proof-of-concept exploit is available for CVE-2026-4617. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4617?

Within 24 hours: Isolate affected systems from public internet access; enable comprehensive logging and monitoring for the /php/api_patient_checkin.php endpoint; notify stakeholders and legal/compliance teams. Within 7 days: Implement WAF rules to block malicious requests to vulnerable endpoints; conduct forensic analysis for signs of exploitation; brief executive leadership on remediation timeline. Within 30 days: Deploy vendor patch immediately upon availability or replace system with patched version; conduct full security audit of authentication mechanisms across all patient-facing systems; implement input validation hardening.

PHP CVE-2026-4617

Q: What is the CVSS score of CVE-2026-4617?

CVE-2026-4617 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14674 MEDIUM

Improper Authorization (CWE-285)

2026-03-24 VulDB

PHP Authentication Bypass Patients Waiting Area Queue Management System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:53 vuln.today

Public exploit code

EUVD ID Assigned

Mar 24, 2026 - 01:00 euvd

EUVD-2026-14674

Analysis Generated

Mar 24, 2026 - 01:00 vuln.today

CVE Published

Mar 24, 2026 - 00:52 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the file /php/api_patient_checkin.php of the component Patient Check-In Module. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SourceCodester Patients Waiting Area Queue Management System 1.0 contains an improper authorization flaw in the ValidateToken function of the Patient Check-In Module that allows unauthenticated remote attackers to bypass access controls. Public exploit code is available for this vulnerability, and no patch has been released. The attack requires no user interaction and could enable unauthorized access to patient check-in functionality.

Technical ContextAI

This vulnerability affects SourceCodester Patients Waiting Area Queue Management System version 1.0 (CPE: cpe:2.3:a:sourcecodester:patients_waiting_area_queue_management_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing patient queues in healthcare waiting areas. The root cause is classified as CWE-285 (Improper Authorization), indicating flawed access control logic in the ValidateToken function of the api_patient_checkin.php endpoint. Rather than properly validating authentication tokens before granting access to patient check-in functionality, the implementation contains a weakness that allows attackers to manipulate requests and bypass token validation entirely, gaining unauthorized access to protected API endpoints without valid credentials.

RemediationAI

No official vendor patch is currently available for this vulnerability based on the CVSS Remediation Level indicator (RL:X). Organizations using SourceCodester Patients Waiting Area Queue Management System 1.0 should immediately implement compensating controls including: deploying a web application firewall (WAF) with rules to validate and sanitize requests to /php/api_patient_checkin.php, implementing network-level access restrictions to limit the Patient Check-In Module to trusted IP ranges only, adding additional authentication layers such as API gateway authentication before requests reach the vulnerable endpoint, and closely monitoring logs for suspicious check-in attempts or token manipulation. Organizations should contact the vendor via https://www.sourcecodester.com/ to request a security patch. Given the public exploit availability at https://gist.github.com/HxH404/0ab53ccba44456b5400a5908414f5ab1, affected organizations should consider migrating to alternative queue management solutions if vendor response is not forthcoming.