Is there a public PoC exploit available for EUVD-2026-18607?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18607. Prioritise patching immediately. EPSS: 0.0%.

Java EUVD-2026-18607

Q: What is the CVSS score of EUVD-2026-18607?

EUVD-2026-18607 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5457 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-xfw6-4rhw-32pm

Java Information Disclosure Google Agentnet Singapore App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 07:00 euvd

EUVD-2026-18607

Analysis Generated

Apr 03, 2026 - 07:00 vuln.today

CVE Published

Apr 03, 2026 - 06:30 nvd

LOW 1.9

DescriptionCVE.org

A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

PropertyGuru AgentNet Singapore App versions up to 23.7.10 on Android expose hard-coded cryptographic keys (SEGMENT_ANDROID_WRITE_KEY and SEGMENT_TOS_WRITE_KEY) in the BuildConfig component, allowing local authenticated attackers to conduct information disclosure and data injection attacks. The vulnerability carries a CVSS score of 1.9 with low confidentiality impact, requires local access and authenticated privileges, and publicly available exploit code exists; however, the vendor has not responded to early disclosure efforts.

Technical ContextAI

The vulnerability exists in com/allproperty/android/agentnet/BuildConfig.java, a configuration file component used by the PropertyGuru AgentNet Singapore App (CPE: cpe:2.3:a:propertyguru:agentnet_singapore_app). The root cause is classified as CWE-321 (Use of Hard-coded Cryptographic Key), a common weakness where sensitive cryptographic material is embedded directly in application code or configuration files. The Segment write keys (SEGMENT_ANDROID_WRITE_KEY and SEGMENT_TOS_WRITE_KEY) are credential-like values used for authenticating API calls to Segment's data pipeline service. By hardcoding these keys rather than protecting them via secure storage mechanisms or environment variables, the application exposes the keys to extraction through local code analysis, package inspection, or decompilation of the APK. This enables unauthorized callers to impersonate the legitimate application when communicating with Segment services.

RemediationAI

Immediate remediation requires PropertyGuru to release a patched version of AgentNet Singapore App that removes hard-coded cryptographic keys from BuildConfig.java and implements secure credential storage mechanisms such as Android Keystore for sensitive API credentials. Users should upgrade to a version beyond 23.7.10 once the vendor releases a patched build. As an interim workaround pending vendor response, users should avoid using untrusted versions of the application and refrain from granting device access to untrusted parties, though this does not fully mitigate the underlying credential exposure. The vendor advisory URL is https://vuldb.com/vuln/355045; additional technical analysis is available at https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-com-allpropert-3262de3f97fb80b5aa5ae52475bf155e (note: vendor did not formally respond to early disclosure).