Joyland AI EUVD-2026-91029

Requires the attacker to hold an adjacent-network or on-path position (same LAN/Wi-Fi segment or a controlled router) relative to a device running the Joyland AI Android app; this is the primary limiting factor and excludes remote internet-only attackers. The specific enabling condition is that the app explicitly opts into cleartext on Android 9+ (via its network security configuration / usesCleartextTraffic setting) where the OS default would otherwise block HTTP, so only data the app actually sends over plain HTTP is exposed. Impact is further limited because it is passive disclosure of transmitted data only - no authentication is required (PR:N) but also no code execution, account takeover, or data modification results.

This is a genuine but low-to-moderate priority issue, not a high-severity emergency. The input CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and is internally consistent with CWE-319 (Cleartext Transmission): an adjacent-network attacker with no privileges or user interaction can passively observe low-impact confidential data, with no integrity or availability consequence. All signals point the same direction and do not conflict: there is no EPSS score provided, no CISA KEV listing, and no public POC referenced, so there is no evidence of active or automatable exploitation. The AV:A (adjacent) rather than AV:N (network) metric correctly constrains real-world risk - an attacker must share the local network or occupy an on-path position (e.g., rogue Wi-Fi, malicious router), which is far more limited than internet-wide exploitability. The only impact is confidentiality-low (VC:L), reflecting exposure of whatever data the app sends over HTTP rather than full account compromise. Bottom line: a legitimate hardening/privacy defect worth remediating in the app, but not a drop-everything vulnerability; it depends entirely on the attacker already being on the victim's network path.

An attacker on the same untrusted Wi-Fi network as a Joyland AI user (e.g., a café or airport hotspot) passively captures the app's cleartext HTTP traffic, reading any data the app transmits without TLS. No public exploit is needed - standard packet-sniffing tools suffice given the low attack complexity and lack of required privileges or user interaction. No public exploit identified at time of analysis.