| शीर्षक | Align Technology My Invisalign(com.aligntech.myinvisalign.emea) 3.12.4 Contentful CDA Tokens Exposure |
|---|
| विवरण | In the Android application com.aligntech.myinvisalign.emea version 3.12.4, Contentful Delivery API credentials (space ID and CDA token) are hardcoded in the client-side code. An attacker who extracts these credentials can directly query the Contentful CDN API to read all entries from both the master (production) and release (pre-production) environments. This exposes sensitive business configurations, marketing strategies, multimedia assets, and help documentation. By analyzing this data, the attacker can gain comprehensive insights into the app's business logic, go-to-market plans, technical release roadmap, and internal knowledge base, leading to severe and multifaceted leakage of trade secrets and intellectual property. |
|---|
| स्रोत | ⚠️ https://www.notion.so/Contentful-CDA-Tokens-Exposure-Leading-to-Unauthorized-Access-to-Master-and-Release-Environments-in--3262de3f97fb802ebd1af88e1264cb9f?source=copy_link |
|---|
| उपयोगकर्ता | fxizenta (UID 28116) |
|---|
| सबमिशन | 17/03/2026 02:10 PM (7 महीनों पहले) |
|---|
| संयम | 03/04/2026 12:20 AM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355044 [Align Technology My Invisalign App 3.12.4 पर Android com.aligntech.myinvisalign.emea BuildConfig.java CDAACCESS_TOKEN कमजोर एन्क्रिप्शन] |
|---|
| अंक | 17 |
|---|