CVE-2026-102670: Joyland AI enables HTTP
Published Oct 1, 2026
·Updated
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.
Affected Software
1 affected component
Joyland AI Joyland AI app
Event History
Oct 1, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions make this exposure relevant?
It is relevant on Android 9 and later, where cleartext HTTP traffic is blocked by default but the Joyland AI app explicitly permits it. An attacker would need network-level access to observe traffic sent over HTTP.
2
What is the practical impact?
The stated impact is limited disclosure of information. The supplied vector does not indicate integrity loss or availability impact.
3
What can be done if an update is not immediately available?
Avoid using the app over untrusted networks where traffic could be intercepted, and prefer networks protected against unauthorized access. The provided data does not identify a vendor patch or a configuration-level mitigation.