CVE-2026-103097CWE-312CWE-540CWE-798hardcoded-credentials

CVE-2026-103097

High · published October 2, 2026

CVSS v3.1

7.5

EPSS

Percentile

4.0

In the wild

Unconfirmed

What it is

An API key is

hardcoded and retrievable from the application package. Since Android

applications can be reverse engineered, embedding sensitive API credentials

directly in the client application may allow unauthorized users to extract and

misuse the key.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00152 · 4.0th percentile
Weaknesses: CWE-312 · Cleartext Storage of Sensitive Information; CWE-540 · Inclusion of Sensitive Information in Source Code; CWE-798 · Use of Hard-coded Credentials
Published: 2026-10-02T05:16Z

References (1)

EPSS history

Timeline