CVE-2026-5456
Hardcoded Cryptographic Key in My Invisalign Android App
Publication date: 2026-04-03
Last updated on: 2026-04-03
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| align_technology | my_invisalign_app | 3.12.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-320 | Key Management Errors |
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability allows an attacker with local access to the device to exploit the use of a hard-coded cryptographic key. This can potentially compromise the confidentiality of sensitive data protected by this key, as the attacker may be able to decrypt or manipulate data that relies on this cryptographic key.
However, the CVSS scores indicate a low severity impact, with a base score of 1.7 (v2.0) and 3.3 (v3.1), suggesting limited impact on integrity and availability, and no impact on authentication.
Can you explain this vulnerability to me?
This vulnerability exists in the Align Technology My Invisalign App version 3.12.4 on Android. It involves an unknown function within the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The issue arises from the manipulation of the argument CDAACCESS_TOKEN, which leads to the use of a hard-coded cryptographic key. This means that the cryptographic key is fixed and embedded in the code, which can be exploited by an attacker.
The attack must be performed locally on the device, and the exploit is publicly available, increasing the risk of exploitation. The vendor was informed early about this vulnerability but did not respond.