Skip to content
NewA calmer, faster ZeroHour
Vulnerability1

CVE-2026-121144

Hardcoded credentials in iRA 2.0 and iRA.ev mobile apps

CVSS 4.0
8.8 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-121144 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Hardcoded service account credentials, API keys, and authorization tokens exist in the iRA 2.0 and iRA.ev mobile applications. An unauthenticated remote attacker can download the app package to extract the sensitive information. This grants access to backend services and may expose sensitive data or enable unauthorized operations. Users of the iRA mobile applications are affected.

What to do: Update iRA 2.0 and iRA.ev mobile applications to address hardcoded credentials in CVE-2026-121144.

ProductAffected
iRA mobile applicationsiRA 2.0 and iRA.ev
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

Weakness
CWE-798
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories