Live › vulnerability › CVE-2026-116105
Go to dashboardHeyCyan App 1.0.103 for Android has a weakness in its Network Security Configuration in AndroidManifest.xml that allows sensitive information to be sent in cleartext. A remote attacker who positions themselves on the network path could read that data, though the sources say exploitation is highly complex and difficult.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 02:39 UTC. All times on this page are UTC.
Users of the HeyCyan Android app version 1.0.103, where the Network Security Configuration appears to permit unencrypted traffic. Teams that run or depend on this app should check whether it sends sensitive data over plain HTTP. Users of other versions or of unrelated apps are not covered by these sources.
No product ranges from the sources yet.
AndroidManifest.xml and check whether android:usesCleartextTraffic is set to true or a network_security_config file permits cleartext domains1.0.103Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116105")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.