API Key Exposure in GV-Cloud Application by GeoVision
CVE-2026-124603

6.2MEDIUM

Key Information:

Vendor

Geovision Inc.

Status
Gv-cloud
Vendor
CVE Published:
10 November 2026

What is CVE-2026-124603?

The GV-Cloud application from GeoVision contains a serious security flaw where an API key is embedded directly within the application package. This hardcoded key can be extracted by malicious actors through reverse engineering techniques typical of Android applications. Such exposure allows unauthorized users to access sensitive functionalities or data secured by the API, posing a significant risk to applications relying on this vulnerable structure.

Affected Version(s)

GV-Cloud Android 1.5.1

GV-Cloud Android 1.5.2

References

https://www.geovision.com.tw/cyber_security.php

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lloyd Lexter Gealon
.