CVE-2026-102670
Deferred Deferred - Pending Action

Joyland AI App Cleartext HTTP Traffic Exposure on Android 9+

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-02
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-102670
EUVD
EUVD-2026-91029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joyland_ai app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Joyland AI app allows cleartext HTTP traffic on Android 9 and later versions, where Android defaults to blocking such traffic for security reasons. This means sensitive data transmitted by the app is not encrypted, making it vulnerable to interception or tampering.

Detection Guidance

To detect this vulnerability, check if the Joyland AI app is sending unencrypted HTTP traffic on Android 9 or later. Use tools like Wireshark or tcpdump to monitor network traffic for cleartext HTTP requests from the app. Alternatively, inspect app traffic using Android's network security configuration settings or a proxy like Burp Suite.

Impact Analysis

This vulnerability could expose your data to attackers on the same network, allowing them to read or alter information sent or received by the app. It may lead to privacy breaches, unauthorized access to personal data, or manipulation of app functionality.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data encryption in transit. Non-compliance could result in legal penalties, fines, or reputational damage due to unauthorized data exposure.

Mitigation Strategies

Disable cleartext HTTP traffic for the Joyland AI app by enforcing HTTPS-only connections. Update the app to a version that supports secure traffic if available. Configure network security policies to block unencrypted traffic from the app.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart