---
id: "CVE-2026-121146"
kind: "vulnerability"
aliases: ["CVE-2026-121146"]
title: "iRA 2.0 and iRA.ev mobile apps write session tokens to logs"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ira-2.0", "ira-ev", "mobile", "other", "vehicle-services"]
not_affected_if: ["no-log-access"]
published_at: "2026-11-04T13:17:27+00:00"
first_seen_at: "2026-11-04T13:27:01+00:00"
updated_at: "2026-11-04T13:28:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121146", "first_seen_at": "2026-11-04T13:27:01+00:00"}]
---

# iRA 2.0 and iRA.ev mobile apps write session tokens to logs

The iRA 2.0 and iRA.ev mobile apps record authentication tokens in application logs kept for development and debugging. An attacker who can read those logs can reuse the session tokens to impersonate the user and reach vehicle information and services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-04T13:27:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121146

## From the sources

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens.



Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_