Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116105HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission

Low 3.7

In plain English

A low-severity security flaw in HeyCyan App. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	HeyCyan App	1.0.103

Weakness: CWE-319, CWE-310 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C

References

VDB-426173 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission vdb-entry
VDB-426173 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-116105 | CVE Analysis and Report third-party-advisory
Submit #1002850 | HeyCyan HeyCyan Android application 1.0.103 Cleartext Transmission of Sensitive Information third-party-advisory
https://github.com/ohackercego/heycyan-vulnerabilitys related