Tata Motors iRA app contains hardcoded credentials
CERT-In reports flaws in Tata Motors connected vehicle apps that enable credential extraction and unauthorized access.
60
CVE-2026-121145
WebView URL validation in iRA 2.0 and iRA.ev apps
- CVSS 4.0
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The iRA 2.0 and iRA.ev mobile applications contain a flaw from insufficient URL and origin validation in WebView. A remote attacker triggers it by loading malicious web content. This lets them interact with app features, steal bearer tokens, impersonate users, and access vehicle data and services.
What to do: Update to the latest version of iRA 2.0 or iRA.ev mobile applications. No workaround given.
| Product | Affected |
|---|---|
| iRA 2.0 | — |
| iRA.ev | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.
- Weakness
- CWE-346, CWE-749
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesTata Motors iRA apps have credential theft flaws
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
50