CVE-2026-124599: Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1
The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.
Affected Software
Event History
Frequently Asked Questions
Who can realistically recover the embedded key material?
Any party able to obtain the GV-Face Android Application package can extract and reverse engineer it. No application privileges or user interaction are required to recover key material from the package.
What could an attacker do after recovering the private key?
Recovered key material could potentially be used to impersonate the application, decrypt protected data, or perform unauthorized cryptographic operations. The specific affected protocols, data, and backend services are not identified in the available information.
Is this exposure limited to devices with a particular configuration?
No configuration dependency is described. The issue stems from key material embedded in the application package, which is inherently obtainable through Android application extraction and reverse engineering.