HeyCyan App EUVD-2026-109593

The AndroidManifest.xml Network Security Configuration of HeyCyan App 1.0.103 permits cleartext (non-TLS) transmission, so sensitive data can be observed by anyone who can inspect the app's network traffic. Realistic exploitation therefore requires the attacker to hold a man-in-the-middle position on the victim's network path (hostile hotspot, ARP/DNS spoofing, or a compromised network hop) - reflected in the AC:H / 'difficult' rating. Limiting factors: exploitation is passive-interception dependent (no server-side trigger), impact is confidentiality-only, it affects the specific Android build 1.0.103, and the exact sensitive data exposed is not described in the available sources. No authentication is required (PR:N) and no user interaction is specified (UI:N).

This is a moderate-severity information-disclosure issue (CVSS 4.0 base 6.3) that the signals consistently place below urgent priority. The vuln.today decision label is 'this_month' - not act_now or emergency - which aligns with the CVSS vector's high attack complexity (AC:H) and the vendor's own statement that exploitability is 'difficult.' The CVSS vector reports AV:N/PR:N/UI:N, so exploitation is network-based and requires no authentication, but AC:H means the attacker must satisfy non-trivial conditions (in practice, a man-in-the-middle position on the victim's network path to observe or downgrade traffic). Impact is limited to confidentiality (VC:L; VI:N/VA:N) - no integrity or availability effect. There is no CISA KEV listing and no EPSS score supplied in the input, so there is no evidence of active or widespread exploitation; a public PoC reference exists (a GitHub repository) but it is not verified as working exploit code. Net assessment: a real but low-urgency weakness - the lack of transport hardening is a genuine defect, but high complexity, confidentiality-only impact, and the absence of exploitation evidence mean this is not an emergency. All intelligence here derives from a single reporter (VulDB), which limits corroboration.

An attacker positioned on the same network path as a victim (e.g., a hostile Wi-Fi hotspot or a compromised upstream hop) intercepts traffic from the HeyCyan Android app, whose Network Security Configuration permits cleartext transmission, and reads sensitive data sent in plaintext. A public PoC reference exists on GitHub but is not verified as working exploit code. The AC:H rating reflects that the attacker must first achieve this interception position, which is not guaranteed.