Hardcoded API Key Vulnerability in GV-Access by GeoVision
CVE-2026-124601

6.2MEDIUM

Key Information:

Vendor

Geovision Inc.

Status
Gv-access
Vendor
CVE Published:
10 November 2026

What is CVE-2026-124601?

The GV-Access package from GeoVision contains a hardcoded API key that can be extracted by reverse engineering the Android application. This issue poses a risk as unauthorized individuals could potentially access and misuse sensitive API credentials. The practice of embedding such credentials directly within client applications compromises the security of the software, making it imperative for developers to implement secure coding practices to safeguard sensitive information.

Affected Version(s)

GV-Access Android 1.6.1

GV-Access Android 1.6.2

References

https://www.geovision.com.tw/cyber_security.php

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lloyd Lexter Gealon
.