Medium severity · published Oct 1, 2026
CVE-2026-102666
Joyland AI hard-coded credentials for push notifications
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Joyland.ai · Joyland
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102666
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102666
third-party-advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/VA-26-275-03.json
vdb-entry
https://www.cve.org/CVERecord?id=CVE-2026-102666
More from Joyland.ai
8.3
CVE-2026-102667
Joyland AI WebView command injection
5.3
CVE-2026-102671
Joyland AI WebView accepts invalid SSL certificates
5.3
CVE-2026-102669
Joyland AI hostname checking disabled
5.3
CVE-2026-102668
Joyland AI accepts TLS certificates without validation
4.3
CVE-2026-102670
Joyland AI enables HTTP