Is there a public PoC exploit available for EUVD-2026-18597?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18597. Prioritise patching immediately. EPSS: 0.0%.

Java EUVD-2026-18597

Q: What is the CVSS score of EUVD-2026-18597?

EUVD-2026-18597 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5453 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-8f3q-gr5f-wwhg

Java Information Disclosure Google S Vantagem Pra Investir App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 05:15 euvd

EUVD-2026-18597

Analysis Generated

Apr 03, 2026 - 05:15 vuln.today

CVE Published

Apr 03, 2026 - 04:30 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability has been found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android. This issue affects some unknown processing of the file br/com/rico/mobile/di/SegmentSettingsModule.java of the component br.com.rico.mobile. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key . The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Hard-coded cryptographic key in Rico's Só Vantagem Pra Investir Android app (version 4.58.32.12421 and earlier) allows local authenticated attackers to manipulate the SEGMENT_WRITE_KEY argument in br/com/rico/mobile/di/SegmentSettingsModule.java, enabling unauthorized data injection and user profile manipulation with low confidentiality impact. The vulnerability requires local access and authenticated privileges; publicly available exploit code exists, but the vendor has not responded to disclosure.

Technical ContextAI

The vulnerability stems from use of hard-coded cryptographic keys (CWE-321) within an Android application's dependency injection module. The SegmentSettingsModule component exposes the SEGMENT_WRITE_KEY parameter with a static, embedded secret rather than protecting it through secure key management practices. This affects the Segment analytics integration (indicated by the key name and tags referencing Google/Segment services), allowing an authenticated local user with access to the device to intercept, manipulate, or inject data into the application's analytics pipeline or backend services. The affected product is identified by CPE string cpe:2.3:a:rico:só_vantagem_pra_investir_app:*:*:*:*:*:*:*:*, indicating Rico's financial services mobile application on Android.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor was contacted early about disclosure but did not respond. Users of Rico Só Vantagem Pra Investir App should monitor for security updates from Rico and avoid using shared or untrusted Android devices to access the application. As a workaround pending vendor action, users should review their account security settings, change passwords, and monitor transaction history for unauthorized changes. Security teams should track Rico's official advisories at https://vuldb.com/vuln/355041/cti for patch availability announcements. The underlying remediation requires Rico to remove hard-coded cryptographic keys from the SegmentSettingsModule, implement secure key management (e.g., Android KeyStore), and release an updated app version.