CVE-2026-4218

myAEDES App aedes.me.beta EngageBayUtils.java information disclosure

State: Published
Severity: 2.0 Low
Published: Mar 16, 2026
Updated: Mar 16, 2026
Reserved: Mar 15, 2026

Description

A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.5 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	2.5 Low	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	1.0 Low	AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-200 Information Disclosure
CWE-284 Improper Access Controls

Affected Products

Product	Versions
myAEDES Appn/a	1.18.0Affected 1.18.1Affected 1.18.2Affected 1.18.3Affected 1.18.4Affected

References

VDB-351142 | myAEDES App aedes.me.beta EngageBayUtils.java information disclosurevdb-entrytechnical-description
VDB-351142 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #770509 | myAEDES myAEDES(aedes.me.beta) 1.18.4 Authorization Credential Exposurethird-party-advisory
https://www.notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_linkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.