{"id":"CVE-2026-53986","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-53986","generatedAt":"2026-10-28T00:56:56.534Z","title":"Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted…","description":"Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.","published":"2026-10-21T17:18:29.000Z","lastModified":"2026-10-22T17:40:47.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-319","CWE-798"],"affected":[],"epss":{"score":0.00216,"percentile":0.11878,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00216,"percentile":0.11364}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T17:18:29.000Z","detail":{"score":"6.9","severity":"MEDIUM","publishedAt":"2026-10-21T17:18:29.243Z"},"summary":"New CVE, medium severity (CVSS 6.9)."}],"references":[{"url":"https://girafit.com/","source":"disclosure@vulncheck.com"},{"url":"https://jblogged.hashnode.dev/cve-2026-53986-hardcoded-turn-credentials-and-cleartext-stun-turn-authentication-in-girafit-camera-app-and-devices","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/girafit-camera-app-hardcoded-turn-credentials-disclosure","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-53986","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}