CVE-2026-42513
HighSummary
This vulnerability in e-Sushrut is due to improper authentication logic that relies on client-side response parameters to determine authentication status.
Risk Assessment
A remote attacker can intercept and modify server responses, allowing authentication bypass and unauthorized access to user accounts.
Recommendation
Move authentication logic to the server and do not rely on client-side data for status verification.
Other vulnerabilities in e-Sushrut
See all- CVE-2026-42518High
This vulnerability in e-Sushrut is due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.
- CVE-2026-42517High
This vulnerability in e-Sushrut is due to the use of reversible Base64 encoding for protecting sensitive data.
- CVE-2026-42516High
This vulnerability in e-Sushrut is due to improper authorization checks during resource access.
- CVE-2026-42515High
This vulnerability in e-Sushrut is due to improper access control in resource access validation.
- CVE-2026-42514High
This vulnerability in e-Sushrut is due to exposure of OTPs in plaintext within API responses.
Original NVD description (English source)
This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status. A remote attacker could exploit this vulnerability by intercepting and modifying the server response. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to user accounts on the targeted system.