PT-2026-25618 · Index Conferences & Exhibitions Organization · Ywf Bpof Apgcs App

Fxizenta + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4219

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App versions up to 1.0.2

Description A flaw exists in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App on Android. The issue affects an unknown functionality within the com/index/event/BuildConfig.java file of the ae.index.apgcs component. Manipulation of the ACCESS KEY/HASH KEY argument can lead to the disclosure of hard-coded credentials. Exploitation is limited to local execution. The exploit has been published. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to 1.0.2 should be updated. As a temporary workaround, consider restricting access to the BuildConfig.java file to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2026-4219

Affected Products

Ywf Bpof Apgcs App

References · 9

• 🔥 https://notion.so/Authorization-Credentials-in-ae-index-apgcs-Lead-to-Exposure-of-Backend-Secrets-3172de3f97fb8040bc30c5519a742251?source=copy_link · Exploit
• 🔥 https://notion.so/Authorization-Credentials-in-ae-index-apgcs-Lead-to-Exposure-of-Backend-Secrets-3172de3f97fb8040bc30c5519a742251 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4219 · Security Note
• https://vuldb.com/?ctiid.351143 · Note
• https://vuldb.com/?submit.770513 · Note
• https://vuldb.com/?id.351143 · Note
• https://twitter.com/CVEnew/status/2033583706573840576 · Twitter Post
• https://t.me/CVEtracker/47533 · Telegram Post
• https://twitter.com/infoflowcloud/status/2033585755050606654 · Twitter Post