The vulnerability CVE-2026-34490 in Johnson Controls XAAP Application on Android is due to cleartext storage of sensitive information (CWE-312). This allows an attacker who has local access on a jailbroken or otherwise compromised device with limited privileges to read sensitive data stored by the application in an unencrypted form. The vulnerability affects all versions prior to 1.53. The CVSS 4.0 base score is 4.8, reflecting a medium severity with local attack vector and low complexity. No vendor advisory or patch information is currently available, and the vendor has not stated any remediation level.

An attacker with local access on a jailbroken or compromised Android device can retrieve sensitive information stored in cleartext by the XAAP Application. This could lead to unauthorized disclosure of sensitive data. The vulnerability does not allow remote exploitation and requires local device compromise first.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running the XAAP Application on jailbroken or compromised devices to reduce risk of sensitive data exposure.