{"id":"CVE-2026-53986","kind":"vulnerability","aliases":["CVE-2026-53986"],"related":[],"title":"Girafit camera app and devices ship shared hardcoded TURN credentials","description":"Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.","summary":"The Girafit camera app for Android and iOS (version 1.9.1 and earlier) and Girafit camera devices contain a static TURN relay username and session token that are identical across all installs. An attacker can extract them by decompiling the app or intercepting unencrypted live view registration traffic, enabling tracking or impersonation, and further exploitation if the TURN relay password is also obtained.","severity":"medium","cvss":6.9,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","camera","girafit","infrastructure","ios","iot"],"not_affected_if":["not-using-girafit"],"how_to_check":"- Check the installed Girafit app version in the app settings or store listing; versions `1.9.1` and earlier are affected.\n- Check whether Girafit camera devices are in use and whether their firmware has been updated; the sources do not give a fixed firmware version.","fix":"- Update the Girafit app past `1.9.1` once a fixed version is published; the sources do not name it.\n- Rotate or change the TURN relay credentials on affected devices; the sources do not say how.\n- Contact the vendor for a firmware update for Girafit camera devices; the sources do not say whether one exists.","status":"open","published_at":"2026-10-21T17:18:29+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:39:01+00:00","updated_at":"2026-10-25T03:39:01+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:39:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Girafit app past `1.9.1` once a fixed version is published; the sources do not name it.\n- Rotate or change the TURN relay credentials on affected devices; the sources do not say how.\n- Contact the vendor for a firmware update for Girafit camera devices; the sources do not say whether one exists.","reach":"internet","title":"Girafit camera app and devices ship shared hardcoded TURN credentials","impact":"medium","summary":"The Girafit camera app for Android and iOS (version 1.9.1 and earlier) and Girafit camera devices contain a static TURN relay username and session token that are identical across all installs. An attacker can extract them by decompiling the app or intercepting unencrypted live view registration traffic, enabling tracking or impersonation, and further exploitation if the TURN relay password is also obtained.","category":"infrastructure","nicknames":[],"who_cares":["girafit","iot","camera","android","ios"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker tracks cameras and impersonates devices using shared credentials","analyst_note":"Confirm the fixed app and firmware versions and whether the TURN relay password is also shared; check the NVD entry for the vendor advisory.","how_to_check":"- Check the installed Girafit app version in the app settings or store listing; versions `1.9.1` and earlier are affected.\n- Check whether Girafit camera devices are in use and whether their firmware has been updated; the sources do not give a fixed firmware version.","needs_analyst":true,"not_affected_if":["not-using-girafit"],"who_is_affected":"Teams that deploy or use Girafit cameras and the Girafit mobile app, since the shared credentials are present in every install and device. The sources do not say which device models or firmware versions are affected beyond the app version. Teams not using Girafit products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":3435,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-53986':13A,16A '1.9.1':32B,92C 'across':51B,140C 'allow':105C 'also':83B 'android':17B,28B,88C 'app':3A,26B,62B,87C,117C 'attack':55B,106C,127C 'camera':2A,18B,25B,37B,86C,97C 'combin':159C 'contain':39B,99C 'credenti':10A,102C 'cve':11A,14A 'decompil':60B,115C 'devic':5A,38B,98C,150C 'earlier':34B,94C 'enabl':70B,152C 'exploit':76B,157C 'extract':57B,129C 'girafit':1A,19B,24B,36B,85C,96C 'hardcod':8A,101C 'ident':50B,139C 'imperson':73B,154C 'infrastructur':20B 'instal':53B,142C 'intercept':64B,119C 'io':21B,30B,90C 'iot':22B 'live':66B,124C 'network':121C 'obtain':84B,108C 'password':81B,164C 'potenti':151C 'registr':68B,126C 'relay':43B,80B,112C,163C 'session':46B,135C 'share':7A,110C 'ship':6A 'static':41B,131C 'tie':145C 'token':47B,136C 'track':71B,153C 'traffic':69B,122C 'turn':9A,42B,79B,111C,132C,162C 'unencrypt':65B,120C 'user':148C 'usernam':44B,113C,133C 'version':31B,91C 'view':67B,125C 'vulner':103C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy or use Girafit cameras and the Girafit mobile app, since the shared credentials are present in every install and device. The sources do not say which device models or firmware versions are affected beyond the app version. Teams not using Girafit products can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-53986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53986","severity":null,"published_at":"2026-10-21T17:18:29+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-53986","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53986","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}