Hayat Mobile
Monthly
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.