Executive brief
The Meesho Online Shopping app for Android contains a cryptographic flaw that could allow sensitive data to be intercepted or tampered with. This vulnerability stems from the use of outdated encryption methods that do not verify the integrity of the data. While difficult to exploit, a successful attack could compromise the confidentiality of user information transmitted by the app.
Technical details
The Meesho Android application (com.meesho.supply) implements insecure cryptography in its /api/endpoint communication. Specifically, the app utilizes AES in CBC mode with PKCS5 padding without an accompanying integrity check (such as HMAC or an AEAD mode like GCM). Furthermore, the encryption key is derived using the weak MD5 hashing algorithm. These flaws make the application's encrypted payloads vulnerable to ciphertext tampering, potential padding oracle attacks, and weak key derivation attacks. Exploitation requires a high level of complexity and network-level access to intercept traffic.
Affected products
- Meesho Online Shopping App up to 27.3
Timeline
- 2026-03: other: Vulnerability discovered
- 2026-04-06: disclosed: Public disclosure of the exploit and vulnerability details
- 2026-04-06: advisory: CVE-2026-5682 published