# CVE-2026-102671: Joyland AI invalid SSL certificate acceptance in WebView

Source: https://junglewise.ai/threats/cve-2026-102671-the-joyland-ai-app-accepts-invalid-ssl-certificates-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102671 · Severity: medium · CVSS 5.3 · Published 2026-10-01

The Joyland AI app disables SSL certificate validation in a hidden advertisement WebView component, allowing an attacker on the same network to intercept and modify encrypted traffic. This creates a foothold for injecting malicious code and accessing sensitive phone data including camera, GPS, microphone, and files.

Technologies: [Joyland.ai](https://junglewise.ai/threats/technologies/joyland-ai). Vendors: [Joyland](https://junglewise.ai/threats/vendors/joyland).

## Quick answers

**Is CVE-2026-102671 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102671 being exploited in the wild.

**How severe is CVE-2026-102671?** Medium severity, with a CVSS score of 5.3, published 1 October 2026.

**Which products and versions are affected?** Joyland.ai all versions.

**Is there a fix for CVE-2026-102671?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102671 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-102671?** Check whether you run Joyland.ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The application fails to validate SSL certificates in its advertisement WebView by default, enabling man-in-the-middle attacks on network traffic. An attacker on an adjacent network can intercept HTTPS communications to the advertisement service and inject arbitrary content. No patch is currently available.

## Affected products

- Joyland Joyland.ai all versions

## Timeline

- 2026-10-01: disclosed

## References

- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-03.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-03.json)
- [https://www.cve.org/CVERecord?id=CVE-2026-102671](https://www.cve.org/CVERecord?id=CVE-2026-102671)

## Related threats

- [Joyland AI cleartext HTTP traffic permitted on Android 9+](https://junglewise.ai/threats/cve-2026-102670-joyland-ai-app-explicitly-permits-cleartext-http-traffic-on)
- [Joyland.ai hostname verification bypass](https://junglewise.ai/threats/cve-2026-102669-joyland-ai-app-does-not-verify-hostnames-allowing-a-malicious)
- [Joyland AI TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-102668-the-joyland-ai-app-accepts-any-tls-certificates-from-any-server)
- [Joyland AI JavaScript injection in WebView via network access](https://junglewise.ai/threats/cve-2026-102667-joyland-ai-app-allows-an-attacker-with-shared-network-access-to)