CVEvulnerability

CVE-2026-103096

7.5 HIGH Published 2026-10-02 Modified 2026-10-02 Official page ↗
Status
Deferred
Published
2026-10-02
Last modified
2026-10-02
Assigner
0df08a0e-a200-4957-9bb0-084f562506f9
CVSS 3.1 (0df08a0e-a200-4957-9bb0-084f562506f9)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312, CWE-540, CWE-798

Description

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Related

Weakness · CWE (3)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-540 Inclusion of Sensitive Information in Source Code weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References