CVE-2026-42514

Received Received - Intake

Plaintext OTP Exposure in e-Sushrut API Enables Account Takeover

Publication date: 2026-04-29

Last updated on: 2026-04-29

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description

This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-29

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-30

EPSS Evaluated

2026-07-05

NVD

CVE-2026-42514

EUVD

EUVD-2026-26197

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Compliance Impact

This vulnerability involves the exposure of OTPs in plaintext within API responses, which could allow unauthorized access to user accounts through interception.

Such unauthorized access and exposure of sensitive authentication data could lead to non-compliance with common data protection standards and regulations like GDPR and HIPAA, which require protection of personal and authentication data to ensure user privacy and security.

Executive Summary

This vulnerability exists in the e-Sushrut system because one-time passwords (OTPs) are exposed in plaintext within API responses.

A remote attacker can exploit this by intercepting these API responses to obtain valid OTPs.

Impact Analysis

If exploited successfully, an attacker could impersonate the targeted user.

This would allow unauthorized access to user accounts on the affected system.