CVE-2026-124598: Hardcoded API Key Discovered in GV-Face Android Application v2.2.1
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any party able to obtain the GV-Face Android application package may be able to reverse engineer it and extract the embedded API key. The vector is network-accessible and does not require prior privileges or user interaction.
What is the likely impact of extracting the key?
The provided scoring indicates high confidentiality impact, while integrity and availability impact are not indicated. The specific API services, permissions, and data accessible with the key are not stated.
How can an organization determine whether it is affected?
Organizations using GV-Face Android Application version 2.2.1 should treat the application package as containing a retrievable hardcoded API key. The available information does not identify other affected versions or provide a remediation version.