Hard-Coded Cryptographic Key in Shinrays Games Triple App

Publication date: 2026-04-02

Last updated on: 2026-04-29

Assigner: VulDB

Description

A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the component cats.goods.sort.sorting.games. Performing a manipulation of the argument AES_IV/AES_PASSWORD results in use of hard-coded cryptographic key . Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-02

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-02

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5420

EUVD

EUVD-2026-18546

Affected Vendors & Products

Vendor	Product	Version / Range
shinrays	games_goods_triple_app	to 1.200 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-320	Key Management Errors
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Shinrays Games Goods Triple App up to version 1.200, specifically in an unknown function within the file jRwTX.java of the component cats.goods.sort.sorting.games. It involves manipulation of the arguments AES_IV or AES_PASSWORD, which leads to the use of a hard-coded cryptographic key. Exploiting this flaw requires local access and is considered difficult due to the high complexity of the attack.

Impact Analysis

The impact of this vulnerability is limited due to its low CVSS scores and the requirement for local access with high attack complexity. However, the use of a hard-coded cryptographic key can potentially weaken the security of encrypted data within the application, possibly allowing an attacker with local access to compromise confidentiality partially.

Hi! I’m here to help you understand CVE-2026-5420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70