CVE-2026-124598
HighCVSS 7.5Summary
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Risk Assessment
Leakage of the API key may enable unauthorized access to associated services and lead to costs or data breaches.
Recommendation
Remove the hardcoded key from the application, revoke it, and implement secure credential storage and rotation mechanisms.
Other vulnerabilities in GV-Face
Original NVD description (English source)
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS