Tata Motors iRA Apps Flaws Allow Credential Theft and Owner Impersonation
First merged summary.
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
CERT-In disclosed four security flaws in Tata Motors iRA 2.0 and iRA.ev mobile applications. Researcher Pranav Rajendran found hardcoded service account credentials, exposed authentication tokens in logs, insufficient WebView URL origin checks, and ineffective SSL pinning. These issues could let attackers steal credentials and impersonate vehicle owners. The apps are fixed in iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
- Four high-severity flaws in iRA 2.0 and iRA.ev apps
- Hardcoded service account credentials in app package
- Exposed authentication tokens in logs
- Insufficient WebView URL origin checks
- Ineffective SSL certificate pinning
- Fixed in iRA 2.0 26.8.2 and iRA.ev 26.9.1
What each outlet adds
beyond the shared facts- Cyber Security NewsDetails four flaws including researcher Pranav Rajendran and debug logs exposed
- Hacker NewsReports hardcoded credentials and insecure WebView configuration
- Vendors
- Tata Motors
- Products
- iRA 2.0iRA.eviRA.ev apps
- Organizations
- CERT-In
Coverage
oldest first · one row per article · UTC- · 6d ago
Cyber Security NewsFirst report
Tata Motors iRA apps have credential theft flaws
CERT-In rates four flaws in Tata Motors iRA 2.0 and iRA.ev apps as high severity allowing credential theft and owner impersonation.
- · 5d ago
Hacker News · security
Tata Motors iRA app contains hardcoded credentials
CERT-In reports flaws in Tata Motors connected vehicle apps that enable credential extraction and unauthorized access.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121144 | Hardcoded credentials in iRA 2.0 and iRA.ev mobile apps | 8.8 | — | ||
CVE-2026-121147+1 related CVE | Ineffective SSL Certificate Pinning in iRA 2.0 and iRA.ev Mobile Apps | 8.5 group max | — | ||
| CVE-2026-121146 | Auth token exposure in Tata iRA 2.0 and iRA.ev mobile apps | 6.8 | — |