---
id: "CVE-2026-53986"
kind: "vulnerability"
aliases: ["CVE-2026-53986"]
title: "Girafit camera app and devices ship shared hardcoded TURN credentials"
severity: "medium"
cvss: 6.9
epss: 0.00216
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["android", "camera", "girafit", "infrastructure", "ios", "iot"]
not_affected_if: ["not-using-girafit"]
published_at: "2026-10-21T17:18:29+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:39:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53986", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-53986", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Girafit camera app and devices ship shared hardcoded TURN credentials

The Girafit camera app for Android and iOS (version 1.9.1 and earlier) and Girafit camera devices contain a static TURN relay username and session token that are identical across all installs. An attacker can extract them by decompiling the app or intercepting unencrypted live view registration traffic, enabling tracking or impersonation, and further exploitation if the TURN relay password is also obtained.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Girafit app version in the app settings or store listing; versions `1.9.1` and earlier are affected.
- Check whether Girafit camera devices are in use and whether their firmware has been updated; the sources do not give a fixed firmware version.

## Fix

- Update the Girafit app past `1.9.1` once a fixed version is published; the sources do not name it.
- Rotate or change the TURN relay credentials on affected devices; the sources do not say how.
- Contact the vendor for a firmware update for Girafit camera devices; the sources do not say whether one exists.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53986
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-53986

## From the sources

Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_