CVE-2026-124600

CriticalCVSS 10.0

Published: 10/11/2026(UTC)Translated: 10/11/2026(UTC)NVD NIST

Summary

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, allowing an attacker to intercept it.

Risk Assessment

Interception of unencrypted traffic may expose user credentials, posing a confidentiality risk and potentially leading to unauthorized access.

Recommendation

Enforce HTTPS encryption for all GV-Face communication on both clients and servers.

Other vulnerabilities in GV-Face

CVE-2026-124598High
An API key is hardcoded and retrievable from the GV-Face package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

Original NVD description (English source)

GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, an attacker with the ability to intercept network traffic.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS