CVE-2026-5471
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Toy Planet Trouble App on Android up to version 1.5.5, a vulnerability was found in the file assets/google-services-desktop.json in the component app.investory.toyfactory. Manipulation of the current_key argument leads to use of a hard-coded cryptographic key. Local access is required.
Risk Assessment
The risk involves exposure of a hard-coded cryptographic key, which could allow an attacker to impersonate or decrypt data.
Recommendation
It is recommended to upgrade the app to a newer version that fixes this vulnerability, or change the key storage architecture.
Original NVD description (English source)
A vulnerability was detected in Investory Toy Planet Trouble App up to 1.5.5 on Android. Impacted is an unknown function of the file assets/google-services-desktop.json of the component app.investory.toyfactory. The manipulation of the argument current_key results in use of hard-coded cryptographic key . The attack must be initiated from a local position. The exploit is now public and may be used.