CVE-2026-124598 describes a vulnerability in the GV-Face package where an API key is hardcoded and can be extracted from the Android application. Because Android apps can be reverse engineered, embedding sensitive API credentials in the client app risks unauthorized access and misuse of the key. This vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no privileges or user interaction required, and it impacts confidentiality.