{"id":"CVE-2026-121146","kind":"vulnerability","aliases":["CVE-2026-121146"],"related":[],"title":"iRA 2.0 and iRA.ev mobile apps write session tokens to logs","description":"This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens.\n\n\n\nSuccessful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.","summary":"The iRA 2.0 and iRA.ev mobile apps record authentication tokens in application logs kept for development and debugging. An attacker who can read those logs can reuse the session tokens to impersonate the user and reach vehicle information and services.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ira-2.0","ira-ev","mobile","other","vehicle-services"],"not_affected_if":["no-log-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:28:07+00:00","updated_at":"2026-11-04T13:28:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-04T13:28:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"iRA 2.0 and iRA.ev mobile apps write session tokens to logs","impact":"high","summary":"The iRA 2.0 and iRA.ev mobile apps record authentication tokens in application logs kept for development and debugging. An attacker who can read those logs can reuse the session tokens to impersonate the user and reach vehicle information and services.","audience":"everyone","category":"other","nicknames":[],"who_cares":["ira-2.0","ira-ev","mobile","vehicle-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker impersonates user and reaches vehicle services","analyst_note":"Find the affected versions and any vendor fix for the iRA 2.0 and iRA.ev apps at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-121146 and the vendor's advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-log-access"],"who_is_affected":"Users of the iRA 2.0 and iRA.ev mobile apps whose app logs can be read by someone else, such as on a shared or compromised device. The sources do not state affected versions or whether a fix exists.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4171,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121146':14A,17A '-2.0':19B '-2026':13A,16A '2.0':2A,30B,74C 'access':99C,131C 'allow':120C 'app':6A,34B 'applic':39B,78C,87C 'associ':126C 'attack':47B,96C,122C 'authent':36B,84C 'could':102C,119C 'cve':12A,15A 'debug':45B,93C 'develop':43B,91C 'due':79C 'ev':22B 'exist':70C 'exploit':103C,115C 'expos':111C 'gain':129C 'imperson':59B,124C 'inform':65B,135C 'ira':1A,18B,21B,29B,73C 'ira-ev':20B 'ira.ev':4A,32B,76C 'kept':41B 'local':95C 'log':11A,40B,52B,88C,101C 'misus':109C 'mobil':5A,23B,33B,77C 'reach':63B 'read':50B 'record':35B,82C 'relat':134C 'retriev':107C 'reus':54B 'servic':27B,67B,137C 'session':8A,56B,112C 'success':114C 'token':9A,37B,57B,85C,113C 'unauthor':130C 'use':89C 'user':61B,127C 'vehicl':26B,64B,133C 'vehicle-servic':25B 'vulner':69C,105C,118C 'write':7A","nicknames":[],"mitigations":[],"who_affected":"Users of the iRA 2.0 and iRA.ev mobile apps whose app logs can be read by someone else, such as on a shared or compromised device. The sources do not state affected versions or whether a fix exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ira20","iraev","medium","mobile","other","vehicleservices"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121146","severity":null,"published_at":"2026-11-04T13:17:27+00:00","modified_at":"2026-11-04T13:17:27+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}