This vulnerability in My Invisalign App 3.12.4 on Android arises from the use of a hard-coded cryptographic key in an unknown function within the BuildConfig.java file of the com.aligntech.myinvisalign.emea component. The issue is triggered by manipulation of the CDAACCESS_TOKEN argument. Exploitation requires local access with low complexity and no user interaction. The CVSS 4.0 base score is 4.8, reflecting medium severity. The vendor has not provided a patch or remediation advice, and the vulnerability remains unmitigated as of the publication date.

The use of a hard-coded cryptographic key can weaken the security of cryptographic operations within the app, potentially allowing an attacker with local access to compromise sensitive data protected by this key. However, the attack vector is limited to local access with low complexity, and no privilege escalation or user interaction is required. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should exercise caution by limiting local access to devices running the affected app version. Monitor vendor channels for any future updates or patches addressing this vulnerability.