Virtuagym CVE-2026-12587

Exploitation requires the attacker to hold a low-privileged authenticated session on the Virtuagym platform - any current or former member account is sufficient. From that session, the attacker must call the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info to retrieve the target member's badge_number, which serves as the static HMAC key. The attacker must also reverse engineer the Virtuagym Android APK to extract the QR code generation algorithm; this barrier is minimal because the application contains no code obfuscation. Exploitation is limited to environments where Resamania's Virtuagym integration is in use for physical access QR codes; deployments not using QR-based physical access are unaffected by the physical-access impact. No network positioning, no admin privileges, and no user interaction by the victim are required once API access is established.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) accurately reflects the network-accessible, low-complexity nature of exploitation requiring only low-privileged authentication. Real-world risk is elevated beyond the raw score by two critical factors: first, the credential forge persists through password resets and logouts, undermining all standard account-recovery defenses; second, the absence of APK obfuscation means the cryptographic logic is trivially recoverable, lowering the technical barrier substantially. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, so exploitation probability cannot be quantified from those signals. The impact is concrete and physical - unauthorized facility access - rather than purely digital. The primary limiting factor is the PR:L requirement: an attacker must first obtain authenticated API access, which constrains opportunistic exploitation but is easily satisfied by any current or former member with valid credentials.

An attacker who is a current or former gym member authenticates to the Virtuagym API with their own low-privileged account and queries the resamania_qr_info endpoint to retrieve a target member's badge_number. They then reverse engineer the publicly downloadable APK - trivially, given the lack of obfuscation - to extract the HMAC construction logic and generate a valid QR code for the victim member. The attacker can then present this forged QR code at physical access readers to enter the facility indefinitely, even after the victim changes their password or the gym attempts to revoke their access, since the static HMAC key is tied to the badge_number rather than session state.