CVE-2026-8990

A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification. This issue was fixed in version 4.4.3

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/05/CVE-2026-8990
https://kidsview.pl/

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Un usuario con acceso físico a un smartphone puede eludir el mecanismo de autenticación de la aplicación móvil Kidsview y otorgarse acceso completo a la cuenta del propietario del dispositivo al interactuar con la notificación push de la aplicación. Este problema se solucionó en la versión 4.4.3

Information

Published : 2026-05-28 14:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-8990

Mitre link : CVE-2026-8990

CVE.ORG link : CVE-2026-8990

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

{"id": "CVE-2026-8990", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8990", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T15:12:50.115280Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "View Concept", "product": "Kidsview", "versions": [{"status": "affected", "version": "4.0.1", "lessThan": "4.4.3", "versionType": "semver"}], "platforms": ["Android", "iOS"], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T14:16:25.170", "references": [{"url": "https://cert.pl/posts/2026/05/CVE-2026-8990", "source": "cvd@cert.pl"}, {"url": "https://kidsview.pl/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-359"}]}], "descriptions": [{"lang": "en", "value": "A user with physical access to a smartphone can bypass\u00a0authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification.\n\nThis issue was fixed in version 4.4.3"}, {"lang": "es", "value": "Un usuario con acceso f\u00edsico a un smartphone puede eludir el mecanismo de autenticaci\u00f3n de la aplicaci\u00f3n m\u00f3vil Kidsview y otorgarse acceso completo a la cuenta del propietario del dispositivo al interactuar con la notificaci\u00f3n push de la aplicaci\u00f3n.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 4.4.3"}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "cvd@cert.pl"}