Is there a public PoC exploit available for CVE-2026-5454?

Yes, a public proof-of-concept exploit is available for CVE-2026-5454. Prioritise patching immediately. EPSS: 0.0%.

Grid CVE-2026-5454

Q: What is the CVSS score of CVE-2026-5454?

CVE-2026-5454 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18599 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-v55w-28r9-q537

Information Disclosure Google Grid Organiser App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 05:15 euvd

EUVD-2026-18599

Analysis Generated

Apr 03, 2026 - 05:15 vuln.today

CVE Published

Apr 03, 2026 - 04:45 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was found in GRID Organiser App up to 1.0.5 on Android. Impacted is an unknown function of the file file res/raw/app.json of the component co.gridapp.organiser. Performing a manipulation of the argument SegmentWriteKey results in use of hard-coded cryptographic key . The attack is only possible with local access. The exploit has been made public and could be used.

AnalysisAI

GRID Organiser App versions 1.0.0 through 1.0.5 on Android expose a hard-coded cryptographic key used for the SegmentWriteKey parameter in the res/raw/app.json component file, enabling local attackers with user-level privileges to manipulate argument values and potentially perform data injection and user profile manipulation. The vulnerability has a CVSS v4.0 score of 1.9 with low confidentiality impact, requires local access and low privileges, and publicly available exploit code exists, though active exploitation has not been confirmed by CISA.

Technical ContextAI

The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a root cause where sensitive cryptographic material is statically embedded in application code or resources. In this case, the GRID Organiser App stores a cryptographic key directly in the res/raw/app.json resource file, which is part of the co.gridapp.organiser component. An attacker with local access to the device can extract this hard-coded key from the application package (APK) and use it to forge or manipulate Segment API write requests, bypassing authentication controls that rely on this key for message integrity or authorization. The Android APK format makes embedded keys particularly vulnerable to extraction through simple decompilation or resource inspection tools.

RemediationAI

Users should update GRID Organiser App to a version newer than 1.0.5 once available. The application developer should release a patched version that removes the hard-coded cryptographic key from res/raw/app.json and implements proper key management practices, such as deriving keys from secure storage, using Android KeyStore for cryptographic material, or implementing certificate pinning for API communication. Until a patch is released, users should limit application installation to trusted Android devices and monitor for suspicious Segment API activity. Developers integrating Segment should never embed write keys in application resources; instead, implement server-side event relay or use client-side token vending services with proper key rotation. References: https://vuldb.com/vuln/355042 and https://nvd.nist.gov/vuln/detail/CVE-2026-5454.