---
id: "CVE-2026-124598"
page: "https://infrastack.ai/live/CVE-2026-124598"
kind: "vulnerability"
aliases: ["CVE-2026-124598"]
title: "GV-Face Android app 2.2.1 contains a hardcoded API key that can be extracted"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "GV-Face", "fixed": [], "affected": "2.2.1 (Android app)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "geovision", "gv-face", "hardcoded-secret", "mobile", "package"]
not_affected_if: ["key-stored-server-side", "package-not-used"]
published_at: "2026-11-10T01:17:18+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:33:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124598", "first_seen_at": "2026-11-10T01:26:41+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-124598", "first_seen_at": "2026-11-10T01:33:51+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-124598", "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf"]}]
exploit_sources: []
---

# GV-Face Android app 2.2.1 contains a hardcoded API key that can be extracted

Link for people: https://infrastack.ai/live/CVE-2026-124598 (this .md is for agents)

The GV-Face package ships an API key embedded in its code, so anyone who decompiles an app built with it can read the key. An attacker who extracts it can misuse the key under the owner's account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GV-Face affected 2.2.1 (Android app) fixed no fixed version listed

## How to check

Check the installed GV-Face Android app version (Settings > Apps > GV-Face); 2.2.1 is the version named in the CVE record. Other versions and iOS are not stated either way. Also check any app of yours that bundles GV-Face code: decompile the release APK and search strings/resources for an API key.

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124598
- 2026-11-10T01:33:51+00:00 analyst https://cve.imfht.com/detail/CVE-2026-124598 — Only source is the CVE List record (via mirror cve.imfht.com): GeoVision GV-Face Android app 2.2.1, hardcoded API key, CVSS 7.5. NVD page returned nothing. No GeoVision advisory yet (index checked by sibling run on CVE-2026-124600), so no fix, no key rotation guidance, no PoC, no exploitation reported. Sibling CVEs: -124599 (hardcoded RSA key), -124600 (cleartext HTTP). Nothing verified; revisit when GeoVision publishes an advisory.

## Documents

- [describes] CVE-2026-124598 (mirror of CVE List V5 record) https://cve.imfht.com/detail/CVE-2026-124598
- [mentions] GeoVision Security Advisory Index https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_Index.pdf

## From the sources

An
API key is hardcoded and retrievable from the GV-Face package. Since
Android applications can be reverse engineered, embedding sensitive API
credentials directly in the client application may allow unauthorized users to
extract and misuse the key.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_