CVE-2026-103097 describes a vulnerability where an API key is embedded directly within an Android application package. Since Android apps can be reverse engineered, attackers can extract this hardcoded key without needing privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to the potential confidentiality impact of unauthorized access to the API key. No information about patches or fixes is provided, and the affected versions are not specified.

The impact is primarily the unauthorized disclosure of a sensitive API key, which can lead to misuse of the associated API or service. The confidentiality of the key is compromised, but there is no direct indication of integrity or availability impact. Exploitation does not require privileges or user interaction, making it easier for attackers to extract the key from the application package.

No patch or official fix information is provided. Since this vulnerability arises from insecure coding practices (hardcoding sensitive credentials), the recommended mitigation is to avoid embedding API keys directly in client-side applications. Instead, use secure methods such as retrieving keys from a secure backend or employing token-based authentication mechanisms. Monitor vendor advisories for any updates or official remediation guidance.