Girafit Camera App
Monthly
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared, static TURN username and session token that is identical across every installation and tied to no specific user or device. Unauthenticated remote attackers can recover this credential by decompiling the app binary or by capturing the cleartext STUN/TURN authentication exchange that occurs during live-view registration, and publicly available exploit code exists. On its own the leak supports tracking and fingerprinting of relay sessions; impersonation or deeper abuse is explicitly gated on also holding the separate TURN relay password, which this vulnerability does not disclose, keeping the assessed impact to confidentiality-only and low severity.
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared, static TURN username and session token that is identical across every installation and tied to no specific user or device. Unauthenticated remote attackers can recover this credential by decompiling the app binary or by capturing the cleartext STUN/TURN authentication exchange that occurs during live-view registration, and publicly available exploit code exists. On its own the leak supports tracking and fingerprinting of relay sessions; impersonation or deeper abuse is explicitly gated on also holding the separate TURN relay password, which this vulnerability does not disclose, keeping the assessed impact to confidentiality-only and low severity.