{"id":"CVE-2026-124601","kind":"vulnerability","aliases":["CVE-2026-124601"],"related":[],"title":"GV-Access: hardcoded API key can be extracted from the Android app","description":"An\nAPI key is hardcoded and retrievable from the GV-Access package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.","summary":"The GV-Access package embeds an API key directly in the client application. Anyone who reverse engineers the Android app can extract the key and use it without authorization.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gv-access","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:51+00:00","updated_at":"2026-11-10T01:28:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GV-Access: hardcoded API key can be extracted from the Android app","impact":"medium","summary":"The GV-Access package embeds an API key directly in the client application. Anyone who reverse engineers the Android app can extract the key and use it without authorization.","audience":"businesses","category":"other","nicknames":[],"who_cares":["android","gv-access"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers extract the embedded key and misuse the API it unlocks.","analyst_note":"Confirm which GV-Access product and version embeds the key, the affected API, and whether a fixed version or key rotation is stated at the NVD entry.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":4516,"output_tokens":341,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124601':16A,19A '-2026':15A,18A 'access':3A,23B,27B,65C 'allow':84C 'android':12A,20B,43B,68C 'anyon':38B 'api':5A,31B,55C,76C 'app':13A,44B 'applic':37B,69C,82C 'author':53B 'client':36B,81C 'credenti':77C 'cve':14A,17A 'direct':33B,78C 'emb':29B 'embed':74C 'engin':41B,73C 'extract':9A,46B,88C 'gv':2A,22B,26B,64C 'gv-access':1A,21B,25B,63C 'hardcod':4A,58C 'key':6A,32B,48B,56C,92C 'may':83C 'misus':90C 'packag':28B,66C 'retriev':60C 'revers':40B,72C 'sensit':75C 'sinc':67C 'unauthor':85C 'use':50B 'user':86C 'without':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","gvaccess","medium","other"],"campaign_type":null,"search_a":"'-124601':16A,19A '-2026':15A,18A 'access':3A 'android':12A 'api':5A 'app':13A 'cve':14A,17A 'extract':9A 'gv':2A 'gv-access':1A 'hardcod':4A 'key':6A","search_b":"'access':23B,27B 'android':20B,43B 'anyon':38B 'api':31B 'app':44B 'applic':37B 'author':53B 'client':36B 'direct':33B 'emb':29B 'engin':41B 'extract':46B 'gv':22B,26B 'gv-access':21B,25B 'key':32B,48B 'packag':28B 'revers':40B 'use':50B 'without':52B","search_c":"'access':65C 'allow':84C 'android':68C 'api':55C,76C 'applic':69C,82C 'client':81C 'credenti':77C 'direct':78C 'embed':74C 'engin':73C 'extract':88C 'gv':64C 'gv-access':63C 'hardcod':58C 'key':56C,92C 'may':83C 'misus':90C 'packag':66C 'retriev':60C 'revers':72C 'sensit':75C 'sinc':67C 'unauthor':85C 'user':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124601","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}