CVE-2026-53986 Details
Description
Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.
A vulnerability exists in the Girafit camera app for Android and iOS, all versions through 1.9.1, as well as in Girafit camera devices. This vulnerability involves hardcoded credentials that allow attackers to access the shared TURN relay username. The username can be obtained by decompiling the app or by intercepting unencrypted network traffic during live view registration. The extracted TURN username and session token, which are static, identical across all installations, and not linked to any specific user or device, could potentially be used for tracking, impersonation, or further exploitation if combined with the TURN relay password.
Users are advised to keep the app and camera firmware updated. Girafit should stop using static credentials, send credential-bearing traffic over TLS, and rotate current usernames and session tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Girafit | <= 1.9.1 (semver) |
CPE
Remediation
| |
| Girafit W750 | All versions |
CPE
Remediation
| |
| Girafit W550S | All versions |
CPE
Remediation
| |
| Girafit W520 | All versions |
CPE
Remediation
| |
| Girafit W150 | All versions |
CPE
Remediation
| |
| Girafit T350S | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |