Authentication Bypass in Kidsview

published 2026-05-28 5 mo ago modified 2026-10-26 14 d ago also EUVD-2026-32901

cvss: 5.3; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification.

This issue was fixed in version 4.4.3

Patch / fix

fixed in 1

View Concept Kidsview 4.4.3

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-05-28)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	4.0	5.3	CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

View Concept Kidsview

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor

References

cert.pl /posts/2026/05/CVE-2026-8990
third-party-advisory
kidsview.pl /
product

Sources

CVE List CVE-2026-8990
NVD CVE-2026-8990

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary