The vulnerability lies in the ValidateToken function within the Patient Check‑In Module. By manipulating the API request, an attacker can bypass the intended token validation and perform actions without proper authorization. This improper authorization can allow unauthorized creation, modification, or viewing of patient records, leading to confidentiality and integrity breaches.

SourceCodester Patients Waiting Area Queue Management System, version 1.0.

The issue has a CVSS score of 6.9, indicating moderate criticality. Exploitation is feasible over the network, and the attack code is publicly available, increasing the likelihood of real‑world attacks even though EPSS data is not provided and the vulnerability is not listed in KEV. Attackers can send specially crafted requests to the /php/api_patient_checkin.php endpoint, exploiting the missing authorization checks to gain unauthorized access to patient data.