---
id: "CVE-2026-124602"
page: "https://infrastack.ai/live/CVE-2026-124602"
kind: "vulnerability"
aliases: ["CVE-2026-124602"]
title: "GV-Access Android app ships embedded RSA private key, extractable by attackers"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "gv-access", "other"]
not_affected_if: []
published_at: "2026-11-10T01:17:18+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:28:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124602", "first_seen_at": "2026-11-10T01:26:41+00:00"}]
exploit_sources: []
---

# GV-Access Android app ships embedded RSA private key, extractable by attackers

Link for people: https://infrastack.ai/live/CVE-2026-124602 (this .md is for agents)

The GV-Access Android app contains an RSA private and public key pair inside its package. An attacker who extracts and reverse engineers the app can recover the private key and use it to impersonate the app, decrypt protected data, or perform unauthorized cryptographic operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124602

## From the sources

The RSA cryptographic
key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_