Hayat Mobile CVE-2026-90983

Exploitation requires the attacker to interact with the Hayat Mobile application whose authentication/trust decisions are performed on the client side (CWE-603), allowing those checks to be bypassed by tampering with the client or sending crafted requests directly to the backend. Per the CVSS vector (PR:N/UI:N/AC:L) no credentials, no victim interaction, and no special configuration are stated as required against affected versions 3.3.0 through pre-3.4.0. The principal LIMITING factor is deployment scope: Hayat Mobile is a specific healthcare provider's application, so an attacker must have access to or knowledge of its endpoints; the affected version window (3.3.0-3.3.x) also bounds exposure, and upgrading to 3.4.0 remediates it. Note the vendor assigns only I:L and A:N, indicating the realistic impact is primarily unauthorized read access rather than full data modification or service disruption.

This is a CWE-603 (Use of Client-Side Authentication) issue in Hayat Mobile scored CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning the vendor/CERT assesses it as network-reachable, low-complexity, and requiring no privileges or user interaction, with high confidentiality and low integrity impact. The high base score is driven by the unauthenticated network vector plus confidentiality loss, which is consistent with a client-side authentication design flaw where trust decisions are made on the device/client and can be bypassed. However, several real-world risk signals are MISSING: no EPSS probability was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The single reference is a TR-CERT (Turkish national CERT) advisory, indicating a credible coordinated-disclosure source but not evidence of exploitation. Net: the CVSS-driven severity is high, but absent EPSS/KEV/POC corroboration this should be treated as a credible-but-unproven-in-the-wild priority; the actual blast radius is limited by the apparently narrow deployment of a single healthcare provider's mobile application rather than widespread internet-facing infrastructure.

A remote attacker interacts directly with the Hayat Mobile application's backend or tampers with the client, where authentication/authorization is enforced client-side (CWE-603), and bypasses the login/trust check to access protected functionality or patient-associated data without valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no user interaction, privileges, or complex preconditions are required. No public exploit code is identified at time of analysis, so any attacker would need to independently discover the client-side check and craft requests that skip it.