The GV-Eye Android application version 3.6.0 contains a hardcoded API key embedded directly in the client application package. This practice violates secure credential management principles (CWE-798) and exposes sensitive API credentials to extraction through reverse engineering. The vulnerability allows an attacker to obtain the API key without authentication, potentially enabling unauthorized access to backend services. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, impacting confidentiality but not integrity or availability.

An attacker who extracts the hardcoded API key can potentially misuse it to access backend APIs or services intended to be protected, leading to unauthorized data disclosure or service misuse. The confidentiality of sensitive information is compromised, but there is no direct indication of impact on integrity or availability.

No official patch or remediation is currently documented for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. As a best practice, avoid using hardcoded credentials in client applications and consider implementing secure credential storage or dynamic credential provisioning once a fix is available.