PT-2026-25771 · Citydata · Citychat

Fxizenta + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4251

Mitre

CVSS v3.1

2.5

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Weakness Enumeration

CWE-255

CWE-256

Related Identifiers

CVE-2026-4251

Affected Products

Citychat

References · 5

• 🔥 https://notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4251 · Security Note
• https://vuldb.com/?ctiid.351209 · Note
• https://vuldb.com/?id.351209 · Note
• https://vuldb.com/?submit.771436 · Note