{"affected":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.face","product":"GV-Face","source":"CNA: GV","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"2.2.1"},{"status":"unaffected","version":"2.2.2"}]}],"cveId":"CVE-2026-124598","cwes":["CWE-321"],"description":"An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794269897969,"publishedAt":1794269897969,"references":[{"source":"CNA: GV","tags":[],"url":"https://www.geovision.com.tw/cyber_security.php"}],"remediation":[],"revision":"670603f9242e98bb8b4298624d8bd5ae284091f28eb902e98df8ea721bc6709d","sources":[{"modifiedAt":1794269897969,"name":"CNA: GV","retrievedAt":1794272957690,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124598"}],"ssvc":null,"status":"published","title":"Hardcoded API Key Discovered in GV-Face Android Application v2.2.1","updatedAt":1794272957690}