Schmooze Dating Mobile Application
Monthly
Extraction of hardcoded credentials and cryptographic keys from the Schmooze dating mobile application lets unauthenticated remote attackers bypass authentication and act as legitimate clients against the vendor's backend and cloud services, with the CPE entry indicating no version is excluded from the flaw. Because the secrets ship inside a publicly distributed client package, any party who obtains the app and decompiles it can recover them without privileges, user interaction, or special server-side conditions (CVSS 4.0 base 9.3, PR:N/UI:N), yielding high confidentiality impact on the client and high confidentiality plus integrity impact on downstream backend/cloud systems. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV, but the low barrier to reproduction and the structural nature of CWE-321 keep the practical risk high; the independent assessment notes that impact is bounded to the resources those specific embedded secrets authorize, and that key rotation plus app re-release invalidates previously extracted material.
Extraction of hardcoded credentials and cryptographic keys from the Schmooze dating mobile application lets unauthenticated remote attackers bypass authentication and act as legitimate clients against the vendor's backend and cloud services, with the CPE entry indicating no version is excluded from the flaw. Because the secrets ship inside a publicly distributed client package, any party who obtains the app and decompiles it can recover them without privileges, user interaction, or special server-side conditions (CVSS 4.0 base 9.3, PR:N/UI:N), yielding high confidentiality impact on the client and high confidentiality plus integrity impact on downstream backend/cloud systems. No public exploit code has been identified at time of analysis and the issue has not been added to CISA KEV, but the low barrier to reproduction and the structural nature of CWE-321 keep the practical risk high; the independent assessment notes that impact is bounded to the resources those specific embedded secrets authorize, and that key rotation plus app re-release invalidates previously extracted material.