CVE-2026-103097

HighCVSS 7.5

Published: 02/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Risk Assessment

API key leakage can lead to unauthorized access to services, API usage costs, or data breaches.

Recommendation

Remove the key from the application and store it securely on the server side, using backend authentication mechanisms. Also rotate the key and implement usage monitoring.

Other vulnerabilities in Android application

CVE-2026-103096High
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS