Local Information Disclosure in Envoy Passport for Android and iPhone

CVE-2018-17500

What is CVE-2018-17500?

The Envoy Passport applications for Android and iPhone contain a vulnerability that allows local attackers to access sensitive information due to hardcoded OAuth credentials stored in plaintext. This security flaw can be exploited by adversaries to retrieve confidential data, potentially leading to further breaches and unauthorized access to user accounts. Ensuring the proper management of sensitive information is critical to maintaining the security posture of these applications.

References