The vulnerability arises from improper authentication logic that relies on client‑side response parameters to determine authentication status. Because the server does not enforce authentication on its own, a malicious actor can intercept the response and modify it, causing the system to accept an unauthorized session. The primary impact is unauthorized access to user accounts, granting the attacker confidentiality and integrity privileges that would normally be protected by the login mechanism. This flaw is typical of an authentication bypass weakness.

The affected product is the Hospital Management Information System known as e‑Sushrut, developed by CDAC‑Noida. All previous versions of this HMIS are vulnerable; specific patch levels are not enumerated in the available data.

The CVSS score of 8.8 classifies the flaw as high severity. Attackers can exploit the issue remotely by intercepting and modifying network traffic between the client and the e‑Sushrut server. Because the EPSS score is not available, the precise probability of exploitation is unclear, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote network interception, and it requires no special privileges beyond the ability to capture or alter traffic to the target system.