CVE-2026-121146: Medium severity vulnerability
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens.
Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the iRA 2.0 and iRA.ev mobile applications are exposed if authentication-token-containing application logs can be accessed locally by another party.
What does an attacker need to exploit it?
The attacker needs local access to the application logs. They can retrieve exposed session tokens from those logs and misuse them without requiring user interaction.
What could an attacker do with a recovered token?
A recovered session token could allow the attacker to impersonate the associated user and access vehicle-related information and services.