CVE-2026-102666CWE-798hardcoded-credentials

CVE-2026-102666

Medium · published October 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-10-02T00:17Z
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/VA-26-275-03.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-102666 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:41Z
    Joyland AI hard-coded credentials for push notifications
    cvelistv5