Contentful CDA Credentials Hardcoded in AlignTech Invisalign Android App

Vulnerability Overview Android application version 3.12.4 contains hardcoded Contentful Delivery API (CDA) credentials (Space ID and CDA token) in the client-side code. Attackers can extract these credentials to directly query the Contentful CDA API, gaining unauthorized read access to both Master (production) and Release (pre-production) environments. Impact Scope Data Exposure: Sensitive business configurations, marketing strategies, multimedia assets, help documentation, and other content management data Business Risk: Severe leakage of commercial logic, go-to-market plans, technical release roadmaps, and intellectual property Affected Environments: Both Master and Release environments in Contentful are accessible via the exposed tokens Reproduction Steps 1. Decompile the APK using 2. Locate the hardcoded Contentful credentials in 3. Use the extracted token and space ID to send GET requests to Contentful's CDN API endpoints Hardcoded Credentials (Code Extract) Remediation Remove hardcoded credentials from client-side code immediately Implement server-side proxy architecture to handle Contentful API authentication Rotate exposed Space ID and CDA tokens Review and audit all application builds for similar hardcoded secrets Implement secure credential management using Android Keystore or remote configuration with proper authentication

Goal Reached Thanks to every supporter — we hit 100%!

Contentful CDA Credentials Hardcoded in AlignTech Invisalign Android App