CVE-2026-116105: HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which versions are known to be affected?
The reported affected version is HeyCyan App 1.0.103 on Android. No information is provided about whether earlier or later versions are affected.
Can this be exploited remotely without authentication or user interaction?
The attack is described as remotely launchable and requires neither privileges nor user interaction. However, exploitation has high complexity and is characterized as difficult.
What is the potential impact if exploitation succeeds?
A successful manipulation may cause sensitive information to be transmitted in cleartext. The reported impact is limited to confidentiality; no integrity or availability impact is identified.
Is a vendor fix or workaround available?
The available information does not identify a fix or workaround. It states that the vendor was contacted before disclosure but did not respond.