Tata Motors iRA apps have credential theft flaws
Original title: Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
Tata Motors’ iRA 2.0 and iRA.ev mobile apps contain four security flaws reported by researcher Pranav Rajendran. Issues include hardcoded credentials and tokens WebView risks exposed debug logs and ineffective SSL pinning. Flaws could let attackers steal credentials impersonate owners and access vehicle services. Users must upgrade to versions 26.8.2 and 26.9.1.
- Hardcoded service account credentials in app package
- Exposed authentication tokens in logs
- Insufficient WebView URL origin checks
- Ineffective SSL certificate pinning
- Fixed in iRA 2.0 26.8.2 and iRA.ev 26.9.1
Impact: steal credentials and impersonate owners
- 1.Upgrade to iRA 2.0 version 26.8.2
- 2.Upgrade to iRA.ev version 26.9.1
- Vendors
- Tata Motors
- Products
- iRA 2.0iRA.ev apps
- Organizations
- CERT-In
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121144 | Hardcoded credentials in iRA 2.0 and iRA.ev mobile apps | 8.8 | — | ||
CVE-2026-121147+1 related CVE | Ineffective SSL Certificate Pinning in iRA 2.0 and iRA.ev Mobile Apps | 8.5 group max | — | ||
| CVE-2026-121146 | Auth token exposure in Tata iRA 2.0 and iRA.ev mobile apps | 6.8 | — |
From the original article
2 min read at cybersecuritynews.com
Tata Motors’ iRA 2. 0 and iRA. ev mobile apps contain four security flaws that could let attackers steal credentials, impersonate car owners, and access vehicle services.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.