CVE-2026-5420

Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key

State: Published
Severity: 2.0 Low
Published: Apr 2, 2026
Updated: Apr 3, 2026
Reserved: Apr 2, 2026

Description

A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the component cats.goods.sort.sorting.games. Performing a manipulation of the argument AES_IV/AES_PASSWORD results in use of hard-coded cryptographic key . Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.5 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	2.5 Low	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	1.0 Low	AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key
CWE-320 Key Management Error

Affected Products

Product	Versions
Goods Triple AppShinrays Games	1Affected

References

VDB-354856 | Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded keyvdb-entrytechnical-description
VDB-354856 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #781740 | Shinrays Games Goods Triple - Cat Goods Sort(cats.goods.sort.sorting.games) 1.200 Exposed Cryptographic Key and IVthird-party-advisory
https://www.notion.so/Exposed-Cryptographic-Key-and-IV-in-cats-goods-sort-sorting-games-3262de3f97fb801499ebc3dfd56e232e?source=copy_linkexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.