CVE-2026-124602: Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1
The RSA cryptographic key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover the keys and potentially use them to impersonate the application, decrypt protected data, or generate unauthorized cryptographic operations.
Affected Software
Event History
Frequently Asked Questions
Who could realistically exploit the exposed key material?
An attacker who obtains the GV-Access application package can extract and reverse engineer it to recover the embedded RSA private and public keys. No account privileges or user interaction are indicated by the supplied vector.
What could an attacker do after recovering the private key?
The recovered key could potentially be used to impersonate the application, decrypt protected data, or perform unauthorized cryptographic operations.
How can I determine whether my deployment is affected?
Deployments using GV-Access Android application version 1.6.1 are identified as affected. The provided information does not identify other affected or fixed versions.