PT-2026-29990 · Alien Technology · My Invisalign App

Fxizenta · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-5456

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Align Technology My Invisalign App version 3.12.4

Description A security issue exists in Align Technology My Invisalign App version 3.12.4 on Android. The issue involves the manipulation of the CDAACCESS TOKEN argument within an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2026-5456

Affected Products

My Invisalign App

References · 7

• 🔥 https://notion.so/Contentful-CDA-Tokens-Exposure-Leading-to-Unauthorized-Access-to-Master-and-Release-Environments-in--3262de3f97fb802ebd1af88e1264cb9f?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5456 · Security Note
• https://vuldb.com/vuln/355044 · Note
• https://twitter.com/cyberbivash/status/2039966959551320501 · Twitter Post
• https://vuldb.com/submit/781763 · Note
• https://twitter.com/CVEnew/status/2040128721848275271 · Twitter Post
• https://vuldb.com/vuln/355044/cti · Note