CVE-2026-104638: onetwothreeneth HospitalManagementSystem sessions.php improper authentication
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the ID argument handled by php/sessions.php. No privileges or user interaction are required according to the supplied severity vector.
Is exploitation likely to be practical?
A public exploit has been disclosed, and the exploitability assessment is marked as proof-of-concept. This makes the issue more actionable for unauthenticated remote attackers.
Which deployments should be treated as affected?
HospitalManagementSystem revisions up to commit 9ef91ed6007314b6473110ed699dff76d158f61d are identified as affected. Because the project uses rolling releases and does not provide release version details, deployments should be checked against their source revision rather than a version number.
Is a vendor fix available?
The available information does not identify a fix or updated release. The project was reportedly notified through an issue report but had not responded at the time of publication.