CVE-2026-4242 Details
Description
A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in the BabyChakra Pregnancy & Parenting App for Android, in versions prior to 5.4.3.0. The issue arises from a hardcoded Segment write key in the application's Configuration.java file. This key can be extracted through reverse engineering and used to send arbitrary tracking events or modify user profiles via Segment's API. Such exploitation could inject fraudulent analytics data, corrupt business intelligence, disrupt user segmentation, and misuse related downstream systems.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 16, 2026CISA-ADP
Assessed Mar 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/?ctiid.351184 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.351184 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.771429 | [email protected] | ExploitTechnical Description |
| https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-app-babychakra-3192de3f97fb8084b6b5cb06f96cdf57?source=copy_link | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-255 | Credentials Management Errors | [email protected] |
| CWE-256 | Plaintext Storage of a Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BabyChakra Pregnancy & Parenting App | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 16, 2026 | New CVE Received | [email protected] |