The vulnerability CVE-2026-5456 affects Align Technology's My Invisalign App version 3.12.4 on Android. It arises from the use of a hard-coded cryptographic key in the app's BuildConfig.java file, linked to the manipulation of the CDAACCESS_TOKEN argument. This flaw could allow a local attacker with limited privileges to potentially compromise cryptographic operations relying on this key. The attack vector is local, requiring access to the device, and no user interaction is necessary. The vulnerability is publicly disclosed with no vendor response or patch available as of the publication date.

The use of a hard-coded cryptographic key weakens the security of cryptographic functions within the app, potentially allowing an attacker with local access to bypass or undermine cryptographic protections. This could lead to unauthorized access to sensitive data or functionality protected by the cryptographic key. However, exploitation requires local access and the vulnerability does not involve user interaction or network vectors, limiting its impact scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should limit local access to devices running the affected app version 3.12.4. Monitor for vendor updates or new releases addressing this issue and apply them promptly once available.