Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

GV-Face Android app sends passwords in clear over network

CVE-2026-124600 · published today
Summary

The GV-Face version 2.2.1 for Android transmits user names and passwords without any encryption, so anyone who can monitor the network could see them. This puts user accounts at risk of being stolen or misused. Upgrade to a version that uses secure HTTPS connections or apply a patch that encrypts the traffic, and consider using a trusted VPN when the app is used on public Wi‑Fi.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
geovision inc. gv-face 2.2.1
Original advisory text
Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1
GV-Face transmits sensitive user credentials and
related authentication data over unencrypted HTTP connections. The HTTP
traffic is not encrypted, an attacker with the ability to intercept network
traffic.
References
Severity
10.0 Critical
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published10 Nov 2026
Updated10 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-124600 · NVD
CVE-2026-124600 · MITRE
Track software like this
Free during beta