Is there a public PoC exploit available for CVE-2026-5452?

Yes, a public proof-of-concept exploit is available for CVE-2026-5452. Prioritise patching immediately. EPSS: 0.0%.

Java CVE-2026-5452

Q: What is the CVSS score of CVE-2026-5452?

CVE-2026-5452 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18577 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-mqg3-gfr2-qw8p

Java Information Disclosure Google Campusconnect App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 03:45 euvd

EUVD-2026-18577

Analysis Generated

Apr 03, 2026 - 03:45 vuln.today

CVE Published

Apr 03, 2026 - 02:45 nvd

LOW 1.9

DescriptionCVE.org

A flaw has been found in UCC CampusConnect App up to 14.3.5 on Android. This vulnerability affects unknown code of the file campusconnect/BuildConfig.java of the component campusconnect.ucc. This manipulation causes use of hard-coded cryptographic key . The attack can only be executed locally. The exploit has been published and may be used.

AnalysisAI

UCC CampusConnect App for Android versions up to 14.3.5 expose hard-coded cryptographic keys in the BuildConfig.java file, allowing local attackers with limited privileges to access sensitive cryptographic material and potentially decrypt or forge authentication tokens. The vulnerability has a low CVSS score of 1.9 due to local-only attack vector and limited confidentiality impact, but publicly available exploit code exists, making it actionable for any user with app access on a shared device.

Technical ContextAI

The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a common Android security anti-pattern where sensitive cryptographic keys are embedded directly in application source code or compiled bytecode. In CampusConnect App, the BuildConfig.java component contains hard-coded keys that can be extracted through straightforward reverse engineering or decompilation of the Android application package (APK). BuildConfig files in Android are typically auto-generated and contain compile-time constants, but embedding cryptographic material there violates fundamental secure coding practices. This is particularly dangerous in Java/Android environments where APK files are easily decompilable, exposing these keys to any local user or attacker with file system access. The exposed keys could be used to decrypt locally stored encrypted data, forge authentication tokens, or impersonate the application in API communications if the keys are used for client-side cryptographic operations.

RemediationAI

UCC should release a patched version of CampusConnect App (15.0.0 or later recommended) that removes all hard-coded cryptographic keys from BuildConfig.java and implements secure key management practices, such as storing keys in the Android Keystore or encrypted SharedPreferences with device-level encryption. End users should update to the patched version immediately via Google Play Store once available. Interim workarounds include disabling BuildConfig exposure by enabling code obfuscation (ProGuard/R8) in release builds, though this is a band-aid measure that does not eliminate the underlying issue. For enterprise deployments, administrators should enforce app updates via mobile device management (MDM) policies and consider restricting CampusConnect to single-user or managed devices. Security-conscious users should avoid installing CampusConnect on shared or rooted/jailbroken devices. Additional context is available at https://vuldb.com/vuln/355040 and the associated Notion document detailing the key exposure: https://www.notion.so/Uploadcare-Private-Key-Exposure-Leading-to-Unauthorized-File-Operations-and-Potential-RCE-in-campusc-3262de3f97fb8057bc67ec4320672d99.