{"id":"CVE-2026-103096","aliases":["EUVD-2026-91146","GHSA-p7gq-p6v3-22xp"],"status":"published","title":"GV-Eye Hardcoded API Key Vulnerability","description":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00152,"percentile":0.04426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-312","CWE-540","CWE-798"],"published":"2026-10-02T00:14:08Z","modified":"2026-10-02T20:16:59Z","products":[{"vendor":"geovision inc.","product":"gv-eye"}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103096"},{"url":"https://github.com/advisories/GHSA-p7gq-p6v3-22xp"}],"sources":{"cve":[{"id":"CVE-2026-103096","title":"GV-Eye Hardcoded API Key Vulnerability","description":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","status":"published","published":"2026-10-02T00:14:08.149Z","modified":"2026-10-02T19:49:37.251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-798","CWE-540","CWE-312"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-91146","description":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","status":"published","published":"2026-10-02T00:14:08Z","modified":"2026-10-02T19:49:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:41.962371Z"}],"ghsa":[{"id":"GHSA-p7gq-p6v3-22xp","title":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can...","description":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","status":"published","published":"2026-10-02T03:31:09Z","modified":"2026-10-02T03:31:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T15:12:41.838372Z"}],"nvd":[{"id":"CVE-2026-103096","description":"API\nkey is hardcoded and retrievable from the application package. Since Android\napplications can be reverse engineered, embedding sensitive API credentials\ndirectly in the client application may allow unauthorized users to extract and\nmisuse the key.","status":"published","published":"2026-10-02T01:16:42.93Z","modified":"2026-10-02T20:16:59.723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-312","CWE-540","CWE-798"],"updated_at":"2026-11-02T14:12:53.41762Z"}]}}