Vulnerability · Published Oct 2, 2026 · Assigned by GV
CVE-2026-103096GV-Eye Hardcoded API Key Vulnerability
High 7.5
In plain English
A high-severity hard-coded credentials in GV-Eye from GeoVision Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GeoVision Inc. | GV-Eye | V3.6.0 |
Weakness: CWE-798, CWE-540, CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.geovision.com.tw/cyber_security.php vendor-advisory