Is there a public PoC exploit available for EUVD-2026-18605?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18605. Prioritise patching immediately. EPSS: 0.0%.

Java EUVD-2026-18605

Q: What is the CVSS score of EUVD-2026-18605?

EUVD-2026-18605 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5456 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-cqgp-9jf3-3w3c

Java Information Disclosure Google My Invisalign App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 06:30 euvd

EUVD-2026-18605

Analysis Generated

Apr 03, 2026 - 06:30 vuln.today

CVE Published

Apr 03, 2026 - 06:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The manipulation of the argument CDAACCESS_TOKEN leads to use of hard-coded cryptographic key . The attack must be carried out locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Align Technology My Invisalign App 3.12.4 on Android exposes a hard-coded cryptographic key in the BuildConfig.java component that can be extracted via manipulation of the CDAACCESS_TOKEN argument, allowing local attackers with limited user privileges to obtain sensitive credentials. The vulnerability carries a low CVSS score (1.9) due to local-only attack vector and minimal confidentiality impact, but publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability stems from the use of hard-coded cryptographic keys (CWE-321) embedded directly in the application's BuildConfig.java file, a compiled Java component within the com.aligntech.myinvisalign.emea package. BuildConfig is a standard Android generated class that stores build-time constants; storing sensitive cryptographic material here violates fundamental secure coding practices, as APK files can be decompiled to reveal hardcoded secrets. The CDAACCESS_TOKEN parameter, likely related to Contentful Data Access tokens used for content delivery, is improperly protected, allowing local processes running with ordinary user privileges to extract or manipulate this credential. This represents a failure in Android application hardening and secrets management practices.

RemediationAI

Align Technology must issue a patched version of My Invisalign App that removes the hard-coded cryptographic key from BuildConfig.java and implements proper secure key storage using Android's KeyStore system or similar platform-provided mechanisms. Users should immediately uninstall My Invisalign App 3.12.4 or restrict its permissions at the device level pending a vendor update. As an interim workaround, device administrators can use MDM (Mobile Device Management) solutions to block installation of version 3.12.4 or enforce restricted app permissions limiting access to sensitive device features. Given the vendor's lack of responsiveness to disclosure, users may consider alternative orthodontic tracking applications or contact Align Technology directly through their official support channels to request an urgent security update. Refer to VulDB record 355044 for additional technical details and references.