The vulnerability is a client‑side authentication flaw in Hayat Mobile that enables authentication bypass. An attacker could substitute or spoof OTP codes to gain unauthorized access to the application, potentially exposing sensitive patient data. The flaw maps to CWE‑603, which describes client‑side credential exposure.

Affected systems include Hayat Health Facilities Inc.’s Hayat Mobile application. The issue applies to all releases from version 3.3.0 up to, but not including, 3.4.0. No other products or versions are listed.

The CVSS score of 8.2 classifies the vulnerability as high severity. No EPSS data is currently available, and it is not listed in the CISA KEV catalog, suggesting limited known exploitation. Nevertheless, because the flaw permits an attacker to bypass authentication through client‑side manipulation, it poses a significant risk if an application user falls for a phishing or malicious link that can trigger the bypass.