Virtuagym
Monthly
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.
Hard-coded HMAC credential exposure in Resamania's Virtuagym mobile application allows a low-privileged attacker to forge unlimited physical access QR codes, bypassing facility entry controls permanently. The static HMAC key - derived from the badge_number parameter - is retrievable via an authenticated API call, and the QR code generation logic can be extracted by reverse engineering the unobfuscated APK. Generated codes remain valid indefinitely regardless of subsequent password changes or session logouts, meaning revocation of legitimate access does not invalidate attacker-forged credentials. No public exploit has been identified at time of analysis, though the low technical barrier significantly elevates practical exploitability.