Google CVE-2026-5682

Q: What is the CVSS score of CVE-2026-5682?

CVE-2026-5682 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19482 LOW

Cryptographic Issues (CWE-310)

2026-04-06 cna@vuldb.com

GHSA-2j2r-9pgw-95hp

Google Information Disclosure

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.9 (LOW)

EUVD ID Assigned

Apr 06, 2026 - 20:22 euvd

EUVD-2026-19482

Analysis Generated

Apr 06, 2026 - 20:22 vuln.today

CVE Published

Apr 06, 2026 - 20:16 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

AnalysisAI

Meesho Online Shopping App versions up to 27.3 on Android implement risky cryptographic algorithms in the /api/endpoint component (com.meesho.supply), enabling remote attackers to disclose sensitive information without authentication. The vulnerability has CVSS 6.3 severity with public exploit code availability, though exploitation requires high attack complexity. This impacts the confidentiality of user data processed through affected API endpoints.

Technical ContextAI

The vulnerability stems from the use of weak or inappropriate cryptographic algorithms (CWE-310: Cryptographic Issues) within the Meesho mobile application's API communication layer. The affected component com.meesho.supply handles API requests via the /api/endpoint path, likely managing authentication tokens, session data, or user credentials. The remote attack vector combined with high attack complexity suggests the weakness may involve cryptographic key derivation, insecure random number generation, or deprecated cipher suites that require specific conditions or detailed knowledge to exploit. Android applications commonly store or transmit sensitive data via HTTP APIs; cryptographic weaknesses in this layer can expose user information during transit or storage.

RemediationAI

Meesho should immediately release a patched version (28.0 or higher) that replaces weak cryptographic algorithms with industry-standard implementations such as AES-256 for encryption and SHA-256/SHA-3 for hashing, and enforces TLS 1.2 or higher for all API communications. Users must update the Meesho app from the Google Play Store to the latest available version. Until an official patch is available, users should avoid transmitting sensitive personal or financial information through the app, use a VPN on untrusted networks to add a transport layer, and monitor their account for unauthorized activity. Developers should review the GitHub disclosure (https://github.com/honestcorrupt/MEESHO-CVE) and the VulDB advisory (https://vuldb.com/vuln/355509) for technical details on the specific weak algorithms in use.