High severity · published Oct 2, 2026
CVE-2026-103097
GV-Eye Relay Payment API Key Vulnerability
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the key.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GV
GV-Eye · GeoVision Inc.
V3.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103097
vendor-advisory
https://www.geovision.com.tw/cyber_security.php
More from GV-Eye
7.5
CVE-2026-103098
GV-Eye Sensitive information exposure in URL query parameter Vulnerability
7.5
CVE-2026-103096
GV-Eye Hardcoded API Key Vulnerability