CVE-2026-103096

HighCVSS 7.5

Published: 02/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Risk Assessment

API key leakage can lead to unauthorized access to services, API usage costs, or data breaches.

Recommendation

Remove the key from the application and store it securely on the server side, using backend authentication mechanisms. Also rotate the key and implement usage monitoring.

Other vulnerabilities in Android application

CVE-2026-103097High
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Original NVD description (English source)

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS