CVE-2026-116105

LowCVSS 3.7

Published: 26/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A weakness has been identified in HeyCyan App 1.0.103 on Android, affecting an unknown function of the AndroidManifest.xml file of the Network Security Configuration component. Executing a manipulation can lead to cleartext transmission of sensitive information; the attack can be launched remotely but requires a high level of complexity and exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Risk Assessment

Cleartext transmission of sensitive information may allow an attacker to intercept it on the network. Due to the high attack complexity, the risk is limited but still relevant.

Recommendation

Limit the use of HeyCyan App and monitor for vendor updates. Where possible, enforce encrypted network connections at the system level.

Other vulnerabilities in HeyCyan App

CVE-2026-116106High
A security vulnerability has been detected in HeyCyan App 1.0.103 on Android, affecting an unknown functionality of the FileProvider component. The manipulation leads to improper access controls and the attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Original NVD description (English source)

A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS