CVE-2026-124600: Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1
Published Nov 10, 2026
·Updated
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.
Affected Software
1 affected component
gv GV-Face Android Application=2.2.1
Event History
Nov 10, 2026
CVE Published
via MITRE·12:21 AM
Data Sourced
via MITRE·12:21 AM
DescriptionWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Deployments using the GV-Face Android Application version 2.2.1 should be prioritized, particularly where an attacker could intercept the application's network traffic.
2
What does an attacker need to exploit this issue?
An attacker needs the ability to intercept network traffic between the application and its services. The supplied CVSS vector indicates no attacker privileges or user interaction are required.