{"affected":[{"defaultStatus":"unaffected","packageName":"tw.com.geovision.gvaccesscontrol","platforms":["Android"],"product":"GV-Access","source":"CNA: GV","vendor":"GeoVision Inc.","versions":[{"status":"affected","version":"1.6.1"},{"status":"unaffected","version":"1.6.2"}]}],"cveId":"CVE-2026-124601","cwes":["CWE-798"],"description":"An\nAPI key is hardcoded and retrievable from the GV-Access package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.2,"severity":"medium","source":"CNA: GV","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794270171586,"publishedAt":1794270171586,"references":[{"source":"CNA: GV","tags":[],"url":"https://www.geovision.com.tw/cyber_security.php"}],"remediation":[],"revision":"2da23fc01ba7508313331240aa85d40755057f8831a399b3f9abad6dbcdebc23","sources":[{"modifiedAt":1794270171586,"name":"CNA: GV","retrievedAt":1794272961067,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124601"}],"ssvc":null,"status":"published","title":"Hardcoded API Key Discovered in GV-Access Android Application v1.6.1","updatedAt":1794272961067}