EUVD-2026-26196Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated and network-reachable (PR:N/AV:N/UI:N), but requires an interception/MITM position to alter the response, so AC:H; account access yields C:H with minor I:L and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status. A remote attacker could exploit this vulnerability by intercepting and modifying the server response.
Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to user accounts on the targeted system.
AnalysisAI
Authentication bypass in CDAC-Noida's e-Sushrut Hospital Management Information System (HMIS) lets remote attackers gain unauthorized access to user accounts by tampering with server responses. The login flow trusts client-side response parameters to decide whether authentication succeeded, so an attacker who intercepts and rewrites the response is treated as authenticated. Reported by CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis, and EPSS is low at 0.31% (54th percentile).
Technical ContextAI
e-Sushrut HMIS is a hospital management platform developed by C-DAC Noida and deployed across Indian healthcare institutions to manage patient, clinical, and administrative records. The root cause is a client-side authentication decision: rather than the server authoritatively establishing session state, the application relies on parameters returned in the server response to signal authentication success or failure. This is the classic client-side trust / reliance-on-untrusted-input class of weakness (aligns with CWE-603 'Use of Client-Side Authentication' and CWE-287 'Improper Authentication'; the NVD CWE field is unpopulated). Because the verdict is rendered on the client, a proxy that flips a 'failure' flag to 'success' is enough to impersonate a valid session. The affected CPE is cpe:2.3:a:cdac-noida:e-sushrut,_hospital_management_information_system_(hmis).
RemediationAI
No specific vendor-released patch version is identified in the available data, so contact C-DAC and follow the guidance in CERT-In advisory CIVN-2026-0207 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207) to obtain the fixed build and apply it once available. Because the flaw is a server-side design error, the durable fix is to move the authentication decision entirely server-side (validate credentials and establish session state on the server, never trust client-visible response flags) - this requires a vendor code change and cannot be fully resolved by operators. As compensating controls: enforce end-to-end TLS with certificate pinning where possible to raise the cost of response interception (trade-off: pinning complicates load-balancer/proxy termination); restrict the HMIS login interface to trusted internal networks or VPN and remove any direct internet exposure (trade-off: reduces remote clinician convenience); and deploy a WAF/reverse-proxy rule set plus monitoring for anomalous authentication responses and repeated login attempts from single sources (trade-off: response-tampering over TLS may not be visible to a network WAF, limiting efficacy).
Account takeover in C-DAC's e-Sushrut Hospital Management Information System (HMIS) arises because one-time passwords (O
Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authen
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today