The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. (CVE-2026-12587)

CVE-2026-12587 is a vulnerability caused by hard-coded credentials in an application that enables unauthorized generation of physical access QR codes. The 'badge_number' parameter serves as a static HMAC private key, retrievable via the API endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. The lack of code obfuscation in the APK allows attackers to extract the cryptographic logic, enabling indefinite generation of valid QR codes regardless of user password changes or logout status.

An attacker who obtains the static 'badge_number' value and reverse engineers the application can generate valid physical access QR codes without authorization. This undermines access control mechanisms, potentially allowing unauthorized physical entry. The vulnerability persists even after users change passwords or log out, indicating a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoint exposing the 'badge_number' parameter and consider implementing code obfuscation to protect cryptographic logic. Additionally, avoid using hard-coded credentials and static keys in application design.