Executive brief
react-native-keys is a React Native library used to encrypt and store API keys in mobile applications. The library stores encryption credentials and encrypted key material as plaintext in compiled native binaries, allowing attackers to extract them using basic static analysis tools. Exposed API keys can be used to compromise backend services, steal data, or perform unauthorized transactions.
Technical details
The vulnerability stems from hardcoded storage of cryptographic secrets in compiled native binaries (libreact-native-keys.so). The library encrypts API keys using AES-256-CBC with a 12-character cipher generated via weak random (Math.random()), then embeds both the cipher and Base64-encoded encrypted chunks as plaintext strings in the compiled binary. Attackers can extract secrets using static analysis tools (strings, Hopper, APK decompilers), combine the Base64 chunks, and decrypt the payload without authentication. The weak cipher generation further enables brute-force attacks. Affected versions through 0.7.11 store secrets in plaintext; no patch version is documented in the advisory.
Affected products
- npm react-native-keys 0.7.11 and prior
Timeline
- 2025-06-09: disclosed
- 2025-07-02: advisory