EUVD-2026-19482
GHSA-2j2r-9pgw-95hp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic controls
|
| Impact | The CVSS 6.3 score reflects moderate risk with low confidentiality impact (VC:L), high attack complexity (AC:H), and no authentication requirement (PR:N). The CVSS vector indicates this is not a critical remote code execution or system-wide compromise, but rather a targeted information disclosure flaw. Public exploit code availability (E:P) elevates practical risk-malicious actors can now attempt attacks without independent research. The high attack complexity suggests exploitation is not trivial or automated at scale, which may limit real-world prevalence compared to simple network-based exploits. However, because the attack is unauthenticated and remote, motivated attackers targeting specific Meesho users remain a credible threat. SSVC considerations: exploitation is publicly disclosed, not automatable at large scale (high complexity), technical impact is information disclosure only (not confidentiality of the entire system). This should be prioritized for patching, but not treated as critical infrastructure emergency. |
| Exploit ScenarioDerived | An attacker on a network path (such as a compromised WiFi network or ISP-level position) intercepts API traffic from a Meesho user's Android app. By analyzing the cryptographic weakness-such as predictable key generation or use of deprecated ciphers-the attacker can decrypt or forge API requests to extract user account information, session tokens, or transaction history. Public exploit code from GitHub allows the attacker to automate the decryption process once they identify the specific weak algorithm in use, though they must still invest effort in capturing and analyzing the network traffic due to high attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Meesho Online Shopping App versions up to 27.3 on Android implement risky cryptographic algorithms in the /api/endpoint component (com.meesho.supply), enabling remote attackers to disclose sensitive information without authentication. The vulnerability has CVSS 6.3 severity with public exploit code availability, though exploitation requires high attack complexity. This impacts the confidentiality of user data processed through affected API endpoints.
RemediationAI
Meesho should immediately release a patched version (28.0 or higher) that replaces weak cryptographic algorithms with industry-standard implementations such as AES-256 for encryption and SHA-256/SHA-3 for hashing, and enforces TLS 1.2 or higher for all API communications. Users must update the Meesho app from the Google Play Store to the latest available version. Until an official patch is available, users should avoid transmitting sensitive personal or financial information through the app, use a VPN on untrusted networks to add a transport layer, and monitor their account for unauthorized activity. Developers should review the GitHub disclosure (https://github.com/honestcorrupt/MEESHO-CVE) and the VulDB advisory (https://vuldb.com/vuln/355509) for technical details on the specific weak algorithms in use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from the use of weak or inappropriate cryptographic algorithms (CWE-310: Cryptographic Issues) within the Meesho mobile application's API communication layer. The affected component com.meesho.supply handles API requests via the /api/endpoint path, likely managing authentication tokens, session data, or user credentials. The remote attack vector combined with high attack complexity suggests the weakness may involve cryptographic key derivation, insecure random number generation, or deprecated cipher suites that require specific conditions or detailed knowledge to exploit. Android applications commonly store or transmit sensitive data via HTTP APIs; cryptographic weaknesses in this layer can expose user information during transit or storage.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB