Ticket Ryutsu Center EUVD-2026-94675

The attacker must acquire the 'Ticket Ryutsu Center' Android application package (available publicly on Google Play) and perform static analysis/decompilation to recover the hard-coded API key embedded in the app - this local access to the binary is the core prerequisite (AV:L). No authentication or user interaction is required to extract the key (PR:N/UI:N). Exploitation is LIMITED by: (1) impact being confined to disclosure of a single API key (C:L; I:N/A:N), and (2) real-world consequence depending on the backend scope/permissions the key confers, which is not documented here. There is no remote network path to trigger this against a running system; the weakness lies in the distributed client binary.

This is a low-to-moderate real-world risk, not a top priority. The input CVSS is 4.0 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - a Local attack vector, low complexity, no privileges, no user interaction, and only Low confidentiality impact (no integrity or availability impact). The Local vector is the key limiter: although PR:N means no authentication is needed, an attacker must first obtain the application package (APK) to extract the hard-coded API key (CWE-798), so this is not a remotely weaponizable network flaw. There is no EPSS score, no CISA KEV listing, and no POC indicator in the supplied data, so exploitation status is: no public exploit identified at time of analysis - though note that hard-coded-credential issues are trivial to find once an APK is decompiled, so absence of a published POC should not be read as difficulty. The 'Authentication Bypass' tag overstates the primary defect, which is credential/API-key disclosure; any downstream bypass depends entirely on what backend privileges the leaked key grants, which the available data does not specify. Overall: a genuine but contained information-disclosure issue in a niche regional app, not a widespread emergency.

An attacker downloads the 'Ticket Ryutsu Center' Android app from Google Play, decompiles the APK, and locates the API key hard-coded in the application code or resources. With low complexity and no authentication required, the attacker can then reuse that key to interact with the application's backend API under the app's identity. No public exploit code is identified, but the extraction technique is standard static analysis.