Vehicle Inspection Viewer CVE-2026-75559

Exploitation requires the attacker to be able to observe or intercept the data transmitted by the 'Vehicle Inspection Certificate Viewer' app (Android or iOS editions), since the sensitive API access ID and access key are included in that transmitted data (CWE-201). Limiting factors: the attacker must gain visibility into the app's client-server communications (e.g., a man-in-the-middle position on the network path or access to captured traffic), rather than exploiting an openly exposed endpoint; impact is confined to disclosure of the embedded integration credentials (C:L, no integrity or availability impact), and the real consequence depends on what those API credentials grant, which the advisory does not specify.

This is a moderate-to-low real-world priority despite the network attack vector. The CVSS 3.0 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects an unauthenticated, low-complexity information-disclosure issue with only LOW confidentiality impact and no integrity or availability impact (consistent with CWE-201, exposure of sensitive information through sent data). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is tempered by the nature of the flaw: although the vector is marked AV:N, exploiting credential leakage in transmitted data realistically requires an attacker to observe or intercept the app's traffic (e.g., man-in-the-middle positioning or analysis of client-server communication), which is not the same as trivial remote exploitation against an exposed service - verify intercept conditions with the vendor/JVN advisory. The disclosed data (API integration access ID and access key) is a credential-exposure concern whose downstream severity depends on what those API credentials unlock, which is not described. Net: a legitimate issue worth patching, but not an emergency given low impact, no KEV, and no known exploit.

An attacker positioned to observe the mobile app's network communications (or inspecting the data it sends) captures sensitive information embedded in the transmitted payload, recovering the API integration access ID and access key. With those credentials, the attacker could then authenticate to the backing API as the application and access or abuse the associated integration. No public proof-of-concept was identified in the provided data.