{"id":"CVE-2026-8990","state":"PUBLISHED","title":"Authentication Bypass in Kidsview","description":"A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification.\n\nThis issue was fixed in version 4.4.3","publishedAt":"2026-05-28T13:27:00.417Z","updatedAt":"2026-05-28T15:14:26.194Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["View Concept Kidsview"],"affected":[{"vendor":"View Concept","product":"Kidsview","defaultStatus":"unaffected","versions":[{"version":"4.0.1","status":"affected","lessThan":"4.4.3","versionType":"semver"}],"platforms":["Android","iOS"]}],"references":["https://cert.pl/posts/2026/05/CVE-2026-8990","https://kidsview.pl/"],"weaknesses":["CWE-288","CWE-359"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/8xxx/CVE-2026-8990.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-8990","state":"PUBLISHED","datePublished":"2026-05-28T13:27:00.417Z","dateUpdated":"2026-05-28T15:14:26.194Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-05-19T13:13:51.711Z"},"containers":{"cna":{"title":"Authentication Bypass in Kidsview","descriptions":[{"lang":"en","value":"A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification.\n\nThis issue was fixed in version 4.4.3"}],"affected":[{"vendor":"View Concept","product":"Kidsview","defaultStatus":"unaffected","versions":[{"version":"4.0.1","status":"affected","lessThan":"4.4.3","versionType":"semver"}],"platforms":["Android","iOS"]}],"references":[{"url":"https://cert.pl/posts/2026/05/CVE-2026-8990","tags":["third-party-advisory"]},{"url":"https://kidsview.pl/","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"PHYSICAL","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-359","description":"CWE-359 Exposure of Private Personal Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-05-28T13:27:00.417Z"},"credits":[{"lang":"en","type":"finder","value":"Jakub Lewandowski"}],"datePublic":"2026-05-28T13:26:00.000Z","impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-28T15:12:50.115280Z","id":"CVE-2026-8990","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-28T15:14:26.194Z"}}]}}}