# CVE-2026-103096: GeoVision mobile application hardcoded API key exposure

Source: https://junglewise.ai/threats/cve-2026-103096-api-key-is-hardcoded-and-retrievable-from-the-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103096 · Severity: high · CVSS 7.5 · Published 2026-10-02

A GeoVision mobile surveillance application contains a hardcoded API key embedded directly in the app package, which can be extracted through reverse engineering. An attacker who obtains this key could impersonate the application to access surveillance systems and retrieve sensitive video data or perform unauthorized actions on cameras and monitoring infrastructure.

Vendors: [Geovision](https://junglewise.ai/threats/vendors/geovision).

## Quick answers

**Is CVE-2026-103096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103096 being exploited in the wild.

**How severe is CVE-2026-103096?** High severity, with a CVSS score of 7.5, published 2 October 2026.

**Which products and versions are affected?** GeoVision Mobile App (unspecified version).

**Is there a fix for CVE-2026-103096?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103096 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103096?** Check whether you run Geovision Mobile App (unspecified version). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a credential exposure flaw where sensitive API authentication material is hardcoded in the Android application binary, making it retrievable via reverse engineering or decompilation. An attacker with network access and possession of the application package can extract the key and use it to authenticate API requests without authorization. No preconditions such as user interaction or authentication bypass are needed once the key is obtained.

## Affected products

- GeoVision Mobile App (unspecified version)

## Timeline

- 2026-10-02: disclosed

## References

- [https://www.geovision.com.tw/cyber_security.php](https://www.geovision.com.tw/cyber_security.php)