Live › vulnerability › CVE-2026-53986
Go to dashboardThe Girafit camera app for Android and iOS (version 1.9.1 and earlier) and Girafit camera devices contain a static TURN relay username and session token that are identical across all installs. An attacker can extract them by decompiling the app or intercepting unencrypted live view registration traffic, enabling tracking or impersonation, and further exploitation if the TURN relay password is also obtained.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deploy or use Girafit cameras and the Girafit mobile app, since the shared credentials are present in every install and device. The sources do not say which device models or firmware versions are affected beyond the app version. Teams not using Girafit products can skip it.
No product ranges from the sources yet.
1.9.1 and earlier are affected.1.9.1 once a fixed version is published; the sources do not name it.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.
This page as .md · .json · in your agent: get_signal("CVE-2026-53986")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.