Threat database

CVE-2026-12587 is a high-severity vulnerability in Resamania Virtuagym involving the use of hard-coded credentials. The application uses a static 'badge_number' as an HMAC private key for generating physical access QR codes. This value is accessible via an API endpoint and can be extracted from the APK due to lack of code obfuscation. An attacker with access to this key and the cryptographic logic can generate valid QR codes indefinitely, bypassing password changes or logouts.