CVE-2026-102666 is a vulnerability in Joyland.ai where hard-coded credentials for the GeTui push notification service are embedded in the application. These credentials can be exploited by an attacker to access the GeTui REST API and send push notifications with arbitrary content to any user, group of users, or all users of the app. This represents a CWE-798 (Use of Hard-coded Credentials) weakness. The vulnerability is remotely exploitable without privileges or user interaction, impacting confidentiality and integrity with no impact on availability.

An attacker can leverage the hard-coded credentials to send unauthorized push notifications to users of the Joyland.ai app. This could lead to misinformation, phishing attempts, or other malicious content being delivered directly to users, potentially undermining user trust and app integrity. The confidentiality and integrity of the push notification system are compromised, but availability is not affected.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should monitor for updates from Joyland and avoid deploying versions of Joyland.ai with known hard-coded credentials. Consider restricting network access to the GeTui API if possible and reviewing app configurations for credential management.