CVE-2026-77875: Hide Photos 4.1.0 Insecure External Storage & Base64 Encoding Weakness

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Insecure Storage of Vault Media Files and Wallet Records in Shared External Storage in Hide Photos – Secure vault 4.1.0 Vulnerability Type: O20. Unencrypted Sensitive Information CVSS v4.0 Base Score: 6.8 (Medium) CVE ID: CVE-2026-77875 Release/Disclosure Date: September 18, 2026 Vendor: QUANTUMTECH LTD Exploitability: Remotely Exploitable (CVSS Vector: CVSS:4.0/AV:N/AC:L/PR:L/UI:N/V:C/VI:N/A:N/C:N/S:N/SA:N) Scope of Impact Affected Versions: Hide Photos (Secure vault) 4.1.0 Root Cause: 1. Vault data is stored in a predictable shared external storage path: 2. The application requests broad storage permissions ( , , , ) 3. Sensitive wallet fields are only Base64-encoded, not encrypted, and can be recovered via 4. The vault password only protects the application UI and is not used as an encryption control for the database or media files Remediation Migrate sensitive data from shared external storage to Android's internal app-private storage Implement true encryption (rather than Base64 encoding) for the wallet database and media files Tighten storage permissions and remove unnecessary broad permission declarations Use the vault password as the encryption key to control access to the database and media files POC / Exploitation Code Step 1 – Create Test Data In the application: 1. Set a vault password 2. Import a test image 3. Create a social network/password record, for example: - Social Network: Gmail - Username: tester - Email: tester@gmail.com - Password: T3sT3rPaSsw0rd123! - Note: My secure Gmail password 4. Lock or force-stop the application without re-entering the vault password Step 2 – Read Vault Media from External Storage Open or copy one of the files: Expected Result: The image can be opened externally while the vault UI remains locked. Step 3 – Copy the SQLite Database Inspect the database: Expected Result: The table exists, and stored values are Base64 strings. Step 4 – Decode Stored Values Expected Result: These decoded values match the records displayed in the locked vault application.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-77875: Hide Photos 4.1.0 Insecure External Storage & Base64 Encoding Weakness