Joyland AI EUVD-2026-91023

No special conditions on the Joyland side - any attacker who obtains the client app can extract the embedded GeTui credentials and call the GeTui REST API remotely without authenticating to Joyland (AV:N/AC:L/PR:N/UI:N). The only meaningful prerequisite is access to a copy of the app binary to recover the credentials, and continued validity of those credentials (the attack is neutralized once Joyland rotates/revokes the GeTui key and ships an updated build). Impact is inherently limited to the GeTui push-notification channel: the attacker can inject notification content and target users/groups/all-users, but cannot directly reach Joyland's backend data stores or achieve code execution through this flaw.

This is a moderate-severity issue (input CVSS 4.0 base 6.9) whose real-world risk is bounded by its impact profile rather than its exploitability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) means exploitation is trivial from an attacker's standpoint - remote, no authentication, no user interaction, low complexity - because the credentials are embedded in the distributed app (CWE-798) and can be recovered by anyone who decompiles the client. However, the impact metrics are deliberately low (VC:L/VI:L/VA:N, no scope change): the abuse is confined to the GeTui push-notification channel (injecting arbitrary notification content, possible exposure of push-targeting data), not code execution, account takeover, or data-store compromise on the Joyland backend. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is best characterized as a reputational/phishing-and-spam vector (mass push of malicious or embarrassing content to the entire user base) rather than a system-compromise priority. One caveat worth verifying: the input Tags label this 'Authentication Bypass,' but the CWE (798) and description describe hard-coded credentials enabling unauthorized API access - technically credential exposure rather than a logic-based auth bypass; this does not change the risk but is a labeling nuance.

An attacker decompiles the publicly distributed Joyland AI mobile app, extracts the hard-coded GeTui REST API credentials, and authenticates directly to the GeTui push service. They then issue a broadcast push notification containing phishing links, scam content, or abusive messaging to every Joyland user at once. No public exploit code was identified in the provided data, but the attack is low-complexity because the credentials ship inside the app and require no authentication to the Joyland platform itself.