CVE-2026-53986: Use of Hard-coded Credentials in Girafit Girafit camera app

The Girafit camera app (Android and iOS) version 1.9.1 and earlier, along with Girafit camera devices, contain hardcoded credentials for the TURN relay service. Attackers can obtain the shared TURN relay username and session token by decompiling the app or intercepting unencrypted network traffic during live view registration. These credentials are static and identical across all installs and are not user- or device-specific. This vulnerability potentially enables attackers to track users, impersonate devices, or conduct further attacks if combined with the TURN relay password.

An attacker who obtains the hardcoded TURN relay username and session token can potentially track users or devices, impersonate legitimate devices, and escalate attacks if the TURN relay password is also compromised. The vulnerability exposes sensitive credentials that are uniform across all app installations, increasing the risk of widespread exploitation. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions and monitor for updates from Girafit. Network traffic encryption and secure credential management should be implemented by the vendor to prevent credential exposure.