CVE-2026-4617 Details

A vulnerability exists in SourceCodester Patients Waiting Area Queue Management System version 1.0, specifically within the Patient Check-In Module. The issue arises in the file '/php/api_patient_checkin.php', where the 'ValidateToken' function is defined but never called. This oversight allows unauthenticated remote attackers to access endpoint handlers for walk-in patient registration and queue record insertion without any credentials or authorization. The vulnerability can be exploited through the application's user interface by any anonymous user with network access to the server.

To address this vulnerability, the 'ValidateToken' function should be integrated into the beginning of each request handler in the 'api_patient_checkin.php' file. This will ensure that proper authentication is enforced before processing any check-in or queue-related actions.