CVE-2026-4242
BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage
- State
- Published
- Severity
- 2.0 Low
- Published
- Mar 16, 2026
- Updated
- Mar 16, 2026
- Reserved
- Mar 15, 2026
Description
A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.5 Low | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 2.5 Low | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 1.0 Low | AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Pregnancy & Parenting AppBabyChakra |
|
References
- VDB-351184 | BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storagevdb-entrytechnical-description
- VDB-351184 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #771429 | BabyChakra Pregnancy & Parenting App(app.babychakra.babychakra) 5.4.3.0 Segment Write Key Exposurethird-party-advisory
- https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-app-babychakra-3192de3f97fb8084b6b5cb06f96cdf57?source=copy_linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.