PT-2026-25615 · Undefined · Undefined

Fxizenta + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4218

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions myAEDES App versions through 1.18.4

Description A flaw exists in myAEDES App on Android that allows information disclosure. The issue is related to the manipulation of the AUTH KEY argument within an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the aedes.me.beta component. This issue is only exploitable with local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations Versions through 1.18.4 should be updated when a fix is available. As a temporary workaround, consider restricting access to the aedes.me.beta component to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2026-4218

Affected Products

Undefined

References · 8

• 🔥 https://notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4218 · Security Note
• https://vuldb.com/?submit.770509 · Note
• https://twitter.com/infoflowcloud/status/2033585772192833821 · Twitter Post
• https://twitter.com/CVEnew/status/2033583707471458547 · Twitter Post
• https://t.me/CVEtracker/47507 · Telegram Post
• https://vuldb.com/?ctiid.351142 · Note
• https://vuldb.com/?id.351142 · Note