A user who physically accesses a smartphone can exploit a flaw in the Kidsview mobile application to bypass its authentication mechanism through a push notification. This flaw allows the attacker to gain full access to the device owner's account, compromising the confidentiality, integrity, and availability of personal data. The weakness aligns with CWE‑288 and CWE‑359, indicating a failure in enforcing proper authentication checks during user interaction events.

The vulnerable product is the Kidsview application distributed by View Concept. Versions prior to 4.4.3 are affected; the fix was introduced in version 4.4.3.

The CVSS score of 5.3 categorizes the vulnerability as medium severity. EPSS data is not provided, but the attack requires the attacker to have physical access to the device and to interact with a push notification, limiting the threat to individuals who can physically obtain the phone. Since the vulnerability is not listed in the CISA KEV catalog, there is no current evidence of widespread exploitation, yet the impact on personal data warrants prompt mitigation.