CVE-2026-124601: Hardcoded API Key Discovered in GV-Access Android Application v1.6.1
An API key is hardcoded and retrievable from the GV-Access package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs access to the GV-Access Android application package so they can reverse engineer it and retrieve the embedded API key. No privileges or user interaction are required according to the supplied vector.
Who is exposed to misuse of the extracted credential?
Any environment or service that accepts the hardcoded API key could be exposed if an unauthorized party extracts and uses it. The available information does not identify the API or the permissions associated with the key.
How can teams determine whether they are affected?
Confirm whether deployed GV-Access Android application version 1.6.1 contains an API key embedded in its package. Review any services that trust that key for unauthorized usage or requests from unexpected sources.