Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12587— Embedded credentials in Virtuagym

Quick assessment

Affected
Resamania Virtuagym
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该漏洞允许未经授权生成物理访问二维码，原因是应用程序中使用了硬编码凭据。二维码的生成机制将 参数用作 HMAC 私钥，该值保持静态，并且可以通过 API 端点 访问。攻击者若能够获取该值并掌握应用程序的加密逻辑（可通过逆向工程 APK 提取，因为代码未进行混淆处理），就可以无限期地生成有效的二维码，即使用户已更改密码或退出登录。

CVSS 8.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Resamania Virtuagym ≤ 21/08/2026 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12587

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Embedded credentials in Virtuagym
Source: CVE Program / CVE List V5
Vulnerability Description
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value of which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application’s cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Resamania Virtuagym 0 ~ 21/08/2026 -

II. Public POCs for CVE-2026-12587

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12587

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-12587 (1)

IV. Related Vulnerabilities

Same weakness: CWE-798

V. Comments for CVE-2026-12587

No comments yet

Leave a comment