CVE-2026-85153: Information Disclosure Vulnerability in Schmooze dating mobile Application
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys.
Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Schmooze Android appto a version that resolves this vulnerability.Fixed in 5.2.8 - Upgrade
Upgrade
Schmooze iOS appto a version that resolves this vulnerability.Fixed in 5.2.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need access to the distributed Schmooze application package and can decompile it to extract embedded credentials and cryptographic keys.
What could exploitation allow an attacker to do?
The extracted secrets could allow unauthorized access to backend and cloud resources. An attacker may also be able to forge client requests against the targeted system.
Are only mobile app users affected?
The issue originates in the client application, but the stated impact includes backend and cloud resources that accept or rely on the embedded credentials or cryptographic keys. Those resources should be considered potentially exposed if the distributed package contains valid secrets.
How can teams determine whether they are exposed?
Review the distributed application package for hardcoded credentials and cryptographic keys, including by decompiling it. Verify whether any discovered values remain valid and can authenticate to backend or cloud resources or be used to forge accepted client requests.
What should be done if the application package contains active secrets?
Revoke and rotate the exposed credentials and cryptographic keys, and update affected backend and cloud access controls. Since application packages can be extracted by unauthenticated parties, replacing the client package alone may not invalidate secrets already obtained.