Is there a public PoC exploit available for EUVD-2026-18799?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18799. Prioritise patching immediately. EPSS: 0.0%.

Toy Planet Trouble App EUVD-2026-18799

Q: What is the CVSS score of EUVD-2026-18799?

EUVD-2026-18799 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5471 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-03 VulDB

GHSA-72gv-p948-6p6r

Information Disclosure Google Toy Planet Trouble App

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 03, 2026 - 16:00 euvd

EUVD-2026-18799

Analysis Generated

Apr 03, 2026 - 16:00 vuln.today

CVE Published

Apr 03, 2026 - 15:45 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was detected in Investory Toy Planet Trouble App up to 1.5.5 on Android. Impacted is an unknown function of the file assets/google-services-desktop.json of the component app.investory.toyfactory. The manipulation of the argument current_key results in use of hard-coded cryptographic key . The attack must be initiated from a local position. The exploit is now public and may be used.

AnalysisAI

Hard-coded cryptographic key exposure in Investory Toy Planet Trouble App up to version 1.5.5 on Android allows local attackers with limited privileges to access the Firebase API key embedded in the assets/google-services-desktop.json file, potentially enabling unauthorized authentication and data access. The vulnerability has a CVSS score of 1.9 with low confidentiality impact, requires local access and low privileges, and publicly available exploit code exists.

Technical ContextAI

The vulnerability stems from CWE-321 (use of hard-coded cryptographic key) where sensitive cryptographic material is stored in plaintext within application assets. Specifically, the google-services-desktop.json configuration file contains a Firebase API key that should be protected or dynamically loaded. The affected component is app.investory.toyfactory running on Android. An attacker with local file system access and basic user privileges can extract the current_key parameter value, which represents the hard-coded cryptographic key. This compromised key can then be used to authenticate against Firebase services as the application, potentially exposing backend data and services that rely on this key for authentication and authorization decisions.

RemediationAI

Users should immediately update to a patched version of Investory Toy Planet Trouble App if available from the Google Play Store or the vendor. The primary remediation is to upgrade to a version after 1.5.5 that removes the hard-coded key from application assets and implements secure credential management (e.g., dynamic Firebase configuration, server-side API key handling, or OAuth-based authentication). As an interim workaround pending an app update, users on shared or multi-user Android devices should ensure the app data and files have restrictive file permissions and avoid downloading or using this app on devices with untrusted local users. No vendor advisory URL was provided in the available references; however, VulDB documentation is available at https://vuldb.com/vuln/355075.