CVE-2026-42514
HighSummary
This vulnerability in e-Sushrut is due to exposure of OTPs in plaintext within API responses.
Risk Assessment
A remote attacker can intercept API responses containing valid OTPs, allowing impersonation of users and unauthorized access to accounts.
Recommendation
Encrypt API responses and never send OTPs in plaintext; use secure communication channels.
Other vulnerabilities in e-Sushrut
See all- CVE-2026-42518High
This vulnerability in e-Sushrut is due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.
- CVE-2026-42517High
This vulnerability in e-Sushrut is due to the use of reversible Base64 encoding for protecting sensitive data.
- CVE-2026-42516High
This vulnerability in e-Sushrut is due to improper authorization checks during resource access.
- CVE-2026-42515High
This vulnerability in e-Sushrut is due to improper access control in resource access validation.
- CVE-2026-42513High
This vulnerability in e-Sushrut is due to improper authentication logic that relies on client-side response parameters to determine authentication status.
Original NVD description (English source)
This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.