Threat database

Joyland.ai contains a vulnerability where its app accepts invalid SSL certificates in the invisible advertisement WebView by default. This improper certificate validation is classified under CWE-295. The vulnerability has a medium severity with a CVSS score of 5.3 and does not affect confidentiality or availability but impacts integrity. All versions of Joyland.ai are affected. No patch or remediation guidance is currently provided.

Joyland.ai, an Android application, permits cleartext HTTP traffic on Android 9 and later versions, where the default behavior is to block such traffic. This vulnerability (CVE-2026-102670) is classified under CWE-319, indicating the cleartext transmission of sensitive information. The issue affects all versions of Joyland.ai. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector and low complexity. No official patch or remediation information is provided, and no known exploits are reported in the wild.

Joyland.ai suffers from improper validation of TLS certificates, specifically failing to verify hostnames. This flaw allows a malicious host to connect or intercept chat messages by presenting a certificate with a mismatched hostname. The vulnerability affects all versions of Joyland.ai. It has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor.

Joyland.ai has a vulnerability (CVE-2026-102668) due to improper TLS certificate validation. The app accepts any TLS certificates from servers without validating them, which can undermine secure communications. This vulnerability has a medium severity with a CVSS score of 6.9. No patch or remediation information is currently available.

Joyland.ai contains a critical vulnerability (CVE-2026-102667) that allows an attacker with shared network access to inject JavaScript into WebView content. This can lead to unauthorized access to clipboard data, arbitrary HTTP requests, and app-internal storage. If the app has previously granted permissions, the attacker could access sensitive device features such as the file system, camera, microphone, and GPS tracking.

Joyland.ai contains hard-coded credentials for the GeTui push notification service. This vulnerability allows an attacker to use these credentials to access the GeTui REST API and send arbitrary push notifications to any user or group of users within the app. The issue affects all versions of Joyland.ai. The CVSS score is 6.5, indicating a medium severity vulnerability.