CVE-2026-12587: Embedded credentials in Virtuagym
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API using the endpoint '/club/idclub/member/idmember/resamaniaqrinfo'. An attacker with access to this value and to the application’s cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to generate valid physical access QR codes?
An attacker needs the static badge_number value for a member and the application's cryptographic logic. The badge_number can be obtained through the resamania_qr_info API endpoint, while the logic can be extracted by reverse engineering the unobfuscated APK.
Will changing a password or logging out invalidate previously generated QR codes?
No. The described mechanism allows valid QR codes to be generated indefinitely, including after the user changes their password or logs out.
How can an organization determine whether a member's badge number is exposed through the affected mechanism?
The relevant value is returned by the /club/_id_club_/member/_id_member_/resamania_qr_info endpoint. Exposure depends on whether an attacker can access that endpoint and obtain the member's badge_number.