{"id":"CVE-2026-124602","kind":"vulnerability","aliases":["CVE-2026-124602"],"related":[],"title":"GV-Access Android app ships embedded RSA private key, extractable by attackers","description":"The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.","summary":"The GV-Access Android app contains an RSA private and public key pair inside its package. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gv-access","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:52+00:00","updated_at":"2026-11-10T01:28:52+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GV-Access Android app ships embedded RSA private key, extractable by attackers","impact":"medium","summary":"The GV-Access Android app contains an RSA private and public key pair inside its package. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","gv-access"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker recovers private key, impersonates app and decrypts protected data","analyst_note":"Find the affected GV-Access version range and vendor fix status at the NVD entry or vendor advisory, since the sources give neither.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone using the GV-Access Android app is potentially exposed, since the private key ships inside the installed app package. The sources do not name affected app versions or say whether the vendor has released a fixed build. Teams running GV-Access for their own users or devices should check with the vendor.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4574,"output_tokens":458,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124602':16A,19A '-2026':15A,18A 'access':3A,23B,27B,88C 'allow':110C 'android':4A,20B,28B,92C 'app':5A,29B,49B,61B 'applic':89C,93C,108C,124C 'attack':13A,42B,112C 'client':107C 'contain':30B 'cryptograph':68B,72C,102C,131C 'cve':14A,17A 'data':64B,127C 'decrypt':62B,125C 'direct':104C 'embed':7A,83C 'engin':47B,99C 'extract':11A,44B,96C 'generat':129C 'gv':2A,22B,26B,87C 'gv-access':1A,21B,25B,86C 'imperson':59B,122C 'includ':75C 'insid':38B,105C 'key':10A,36B,54B,73C,78C,81C,103C,116C 'materi':74C 'may':109C 'oper':69B,132C 'packag':40B,90C 'pair':37B 'perform':66B 'potenti':118C 'privat':9A,33B,53B,77C,101C 'protect':63B,126C 'public':35B,80C 'recov':51B,114C 'revers':46B,98C 'rsa':8A,32B,71C 'ship':6A 'store':100C 'unauthor':67B,130C 'use':56B,119C 'within':84C","nicknames":[],"mitigations":[],"who_affected":"Anyone using the GV-Access Android app is potentially exposed, since the private key ships inside the installed app package. The sources do not name affected app versions or say whether the vendor has released a fixed build. Teams running GV-Access for their own users or devices should check with the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","gvaccess","medium","other"],"campaign_type":null,"search_a":"'-124602':16A,19A '-2026':15A,18A 'access':3A 'android':4A 'app':5A 'attack':13A 'cve':14A,17A 'embed':7A 'extract':11A 'gv':2A 'gv-access':1A 'key':10A 'privat':9A 'rsa':8A 'ship':6A","search_b":"'access':23B,27B 'android':20B,28B 'app':29B,49B,61B 'attack':42B 'contain':30B 'cryptograph':68B 'data':64B 'decrypt':62B 'engin':47B 'extract':44B 'gv':22B,26B 'gv-access':21B,25B 'imperson':59B 'insid':38B 'key':36B,54B 'oper':69B 'packag':40B 'pair':37B 'perform':66B 'privat':33B,53B 'protect':63B 'public':35B 'recov':51B 'revers':46B 'rsa':32B 'unauthor':67B 'use':56B","search_c":"'access':88C 'allow':110C 'android':92C 'applic':89C,93C,108C,124C 'attack':112C 'client':107C 'cryptograph':72C,102C,131C 'data':127C 'decrypt':125C 'direct':104C 'embed':83C 'engin':99C 'extract':96C 'generat':129C 'gv':87C 'gv-access':86C 'imperson':122C 'includ':75C 'insid':105C 'key':73C,78C,81C,103C,116C 'materi':74C 'may':109C 'oper':132C 'packag':90C 'potenti':118C 'privat':77C,101C 'protect':126C 'public':80C 'recov':114C 'revers':98C 'rsa':71C 'store':100C 'unauthor':130C 'use':119C 'within':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0df08a0e-a200-4957-9bb0-084f562506f9","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124602","severity":null,"published_at":"2026-11-10T01:17:18+00:00","modified_at":"2026-11-10T01:17:18+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}