CVE-2026-8990
Authentication Bypass in Kidsview Mobile App via Push Notifications
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kidsview | kidsview | 4.4.3 |
| kidsview | kidsview | to 4.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the Kidsview mobile application to version 4.4.3 or later, as this issue was fixed in that version.
Additionally, restrict physical access to smartphones running vulnerable versions of the app (from 4.0.1 up to 4.4.3) to prevent unauthorized users from interacting with push notifications and bypassing authentication.
Can you explain this vulnerability to me?
This vulnerability exists in the Kidsview mobile application and allows a user with physical access to a smartphone to bypass the app's authentication mechanism.
By interacting with the application's push notification, the attacker can gain full access to the device owner's account.
The issue affects versions from 4.0.1 up to 4.4.3 and was fixed in version 4.4.3.
How can this vulnerability impact me? :
If an attacker has physical access to your smartphone, they can exploit this vulnerability to bypass authentication and gain full access to your Kidsview account.
This could lead to unauthorized access to sensitive information stored or accessible through the app, potentially compromising your privacy and security.