← Voltar para CVEs

CVE-2026-5456

LOW

3.3

Descricao

A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The manipulation of the argument CDAACCESS_TOKEN leads to use of hard-coded cryptographic key . The attack must be carried out locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Detalhes CVE

Pontuacao CVSS v3.13.3

SeveridadeLOW

Vetor CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vetor de ataqueLOCAL

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado4/3/2026

Ultima modificacao4/3/2026

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-320CWE-321

Referencias

https://vuldb.com/submit/781763(cna@vuldb.com)

https://vuldb.com/vuln/355044(cna@vuldb.com)

https://vuldb.com/vuln/355044/cti(cna@vuldb.com)

https://www.notion.so/Contentful-CDA-Tokens-Exposure-Leading-to-Unauthorized-Access-to-Master-and-Release-Environments-in--3262de3f97fb802ebd1af88e1264cb9f?source=copy_link(cna@vuldb.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.