CVE-2025-61120: AG Life Logger Android App · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, organizations and users should immediately update the AG Life Logger app to a patched version once available. Until then, network traffic should be monitored for suspicious activity, and use of the app on untrusted networks should be minimized. Developers must implement strong encryption protocols (e.g., TLS 1.3) to protect credentials in transit and avoid exposing sensitive tokens. Verification codes should be generated using cryptographically secure random number generators to prevent predictability. Rate limiting and account lockout mechanisms should be enforced to deter brute-force attempts. Cloud resource access should be restricted with robust identity and access management policies, including multi-factor authentication where feasible. Regular security audits and penetration testing of the app and backend services are recommended to identify and remediate similar issues. End users should be educated on the risks of using outdated app versions and encouraged to report suspicious account activity promptly.
Description
AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force account logins feasible. Successful exploitation could result in account compromise, privacy breaches, and abuse of cloud resources.