GV-FACE · CVE-2026-124598 · Package
NO FIX YET
The GV-Face package ships an API key embedded in its code, so anyone who decompiles an app built with it can read the key. An attacker who extracts it can misuse the key under the owner's account.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that ship an Android application with the GV-Face package embedded. The exposure comes from the key being bundled into the client app, so server-only use of the package is not described as affected. The sources do not list affected versions.
Not affected if key-stored-server-side, package-not-used
Who cares android, geovision, gv-face, hardcoded-secret, mobile
2.2.1 is the version named in the CVE recordUnknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.