CVE-2026-12587: CWE-798: Use of Hard-coded Credentials in Resamania Virtuagym

This vulnerability arises from the use of a hard-coded credential ('badge_number') as the HMAC private key in Resamania Virtuagym's QR code generation mechanism. The 'badge_number' remains static and is retrievable through the API endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. Because the APK lacks code obfuscation, an attacker can reverse engineer the cryptographic logic to generate valid QR codes indefinitely, enabling unauthorized physical access even after user credential changes or logouts.

An attacker who obtains the static 'badge_number' and the cryptographic logic can generate valid physical access QR codes indefinitely. This allows unauthorized physical access to facilities controlled by the Virtuagym system, bypassing authentication controls such as password changes or user logout. The vulnerability compromises the integrity of physical access control and could lead to unauthorized entry.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the API endpoint exposing the 'badge_number' and consider monitoring for unauthorized QR code generation. Additionally, the vendor should implement code obfuscation and replace hard-coded credentials with secure, dynamic key management.