Hard-coded Credential Vulnerability in AM CLUB Mobile Application by Liviero Marco
CVE-2026-103906

7.8HIGH

Key Information:

Vendor

Am Automatic Machines

Status
Am Club
Vendor
CVE Published:
9 November 2026

What is CVE-2026-103906?

A vulnerability has been identified in the AM CLUB mobile application where hard-coded MQTT credentials are utilized. This security flaw permits an authenticated attacker to connect to the MQTT broker, which potentially allows unauthorized access to sensitive data and enables actions across tenant boundaries. Such exposures can lead to significant security concerns and data integrity issues within the application, necessitating immediate attention to credential management practices.

Affected Version(s)

am_club iOS 1.7.194 < 1.8.198

References

https://github.com/livieromarco/security-advisories/blob/...
technical-description

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Liviero Marco
CSIRT-IT
.