{"id":"CVE-2026-124598","kind":"vulnerability","aliases":["CVE-2026-124598"],"related":[],"title":"GV-Face Android app 2.2.1 contains a hardcoded API key that can be extracted","description":"An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.","summary":"The GV-Face package ships an API key embedded in its code, so anyone who decompiles an app built with it can read the key. An attacker who extracts it can misuse the key under the owner's account.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GV-Face","fixed":[],"affected":"2.2.1 (Android app)","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","geovision","gv-face","hardcoded-secret","mobile","package"],"not_affected_if":["key-stored-server-side","package-not-used"],"how_to_check":"Check the installed GV-Face Android app version (Settings > Apps > GV-Face); 2.2.1 is the version named in the CVE record. Other versions and iOS are not stated either way. Also check any app of yours that bundles GV-Face code: decompile the release APK and search strings/resources for an API key.","fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:30+00:00","updated_at":"2026-11-10T01:33:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T01:28:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GV-Face: hardcoded API key in the Android package can be extracted","impact":"medium","summary":"The GV-Face package ships an API key embedded in its code, so anyone who decompiles an app built with it can read the key. An attacker who extracts it can misuse the key under the owner's account.","audience":"developers","category":"package","nicknames":[],"who_cares":["android","gv-face","mobile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker extracts the key and misuses the API account","analyst_note":"Identify the affected GV-Face versions and the vendor fix from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-124598) and the package registry.","how_to_check":"- Search the app's build and source for the GV-Face package and look for a hardcoded API key string\n- Decompile the release APK and search its strings and resources for the key\n- Check the GV-Face version in your dependency files against the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["key-stored-server-side","package-not-used"],"who_is_affected":"Teams that ship an Android application with the GV-Face package embedded. The exposure comes from the key being bundled into the client app, so server-only use of the package is not described as affected. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4515,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected GV-Face versions and the vendor fix from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-124598) and the package registry.","search":"'-124598':18A,21A '-2026':17A,20A '2.2.1':6A 'account':74B 'allow':105C 'android':4A,25B,89C 'anyon':49B 'api':10A,42B,76C,97C 'app':5A,53B 'applic':90C,103C 'attack':62B 'built':54B 'client':102C 'code':47B 'contain':7A 'credenti':98C 'cve':16A,19A 'decompil':51B 'direct':99C 'embed':44B,95C 'engin':94C 'extract':15A,64B,109C 'face':3A,24A,29B,38B,86C 'geovis':26B 'gv':2A,23A,28B,37B,85C 'gv-face':1A,22A,27B,36B,84C 'hardcod':9A,31B,79C 'hardcoded-secret':30B 'key':11A,43B,60B,69B,77C,113C 'may':104C 'misus':67B,111C 'mobil':33B 'owner':72B 'packag':34B,39B,87C 'read':58B 'retriev':81C 'revers':93C 'secret':32B 'sensit':96C 'ship':40B 'sinc':88C 'unauthor':106C 'user':107C","nicknames":[],"mitigations":[],"who_affected":"Teams that ship an Android application with the GV-Face package embedded. The exposure comes from the key being bundled into the client app, so server-only use of the package is not described as affected. The sources do not list affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["gvface"],"ptokens":["face","gv"],"labels":["android","geovision","gvface","hardcodedsecret","high","mobile","package"],"campaign_type":null,"search_a":"'-124598':18A,21A '-2026':17A,20A '2.2.1':6A 'android':4A 'api':10A 'app':5A 'contain':7A 'cve':16A,19A 'extract':15A 'face':3A,24A 'gv':2A,23A 'gv-face':1A,22A 'hardcod':9A 'key':11A","search_b":"'account':74B 'android':25B 'anyon':49B 'api':42B 'app':53B 'attack':62B 'built':54B 'code':47B 'decompil':51B 'embed':44B 'extract':64B 'face':29B,38B 'geovis':26B 'gv':28B,37B 'gv-face':27B,36B 'hardcod':31B 'hardcoded-secret':30B 'key':43B,60B,69B 'misus':67B 'mobil':33B 'owner':72B 'packag':34B,39B 'read':58B 'secret':32B 'ship':40B","search_c":"'allow':105C 'android':89C 'api':76C,97C 'applic':90C,103C 'client':102C 'credenti':98C 'direct':99C 'embed':95C 'engin':94C 'extract':109C 'face':86C 'gv':85C 'gv-face':84C 'hardcod':79C 'key':77C,113C 'may':104C 'misus':111C 'packag':87C 'retriev':81C 'revers':93C 'sensit':96C 'sinc':88C 'unauthor':106C 'user':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124598","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124598:2383","url":"https://cve.imfht.com/detail/CVE-2026-124598","severity":null,"published_at":"2026-11-10T01:33:51+00:00","modified_at":"2026-11-10T01:33:51+00:00","first_seen_at":"2026-11-10T01:33:51+00:00","fetched_at":"2026-11-10T01:33:51+00:00","note":"Only source is the CVE List record (via mirror cve.imfht.com): GeoVision GV-Face Android app 2.2.1, hardcoded API key, CVSS 7.5. NVD page returned nothing. No GeoVision advisory yet (index checked by sibling run on CVE-2026-124600), so no fix, no key rotation guidance, no PoC, no exploitation reported. Sibling CVEs: -124599 (hardcoded RSA key), -124600 (cleartext HTTP). Nothing verified; revisit when GeoVision publishes an advisory.","cites":["https://cve.imfht.com/detail/CVE-2026-124598","https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf"]}],"documents":[{"id":112460,"url":"https://cve.imfht.com/detail/CVE-2026-124598","title":"CVE-2026-124598 (mirror of CVE List V5 record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112442,"url":"https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf","title":"GeoVision Security Advisory Index","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}