CVE-2026-124601 describes a vulnerability in the GV-Access package where an API key is hardcoded and can be retrieved from the Android application. Because Android apps can be reverse engineered, embedding sensitive API credentials in the client app risks unauthorized extraction and misuse of the key.