CVE-2026-92861 Details
Description
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application.
A vulnerability exists in the Android application "Ticket Ryutsu Center" by Wavedash Co., Ltd., affecting versions 4.1.9 and earlier. The issue stems from hard-coded credentials that could allow an attacker to obtain an API key used by the application.
Users are advised to update the application to version 4.2.0 or later, which removes the hard-coded API key and deactivates the previously vulnerable key. The developer has indicated that users should update the app immediately when prompted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN53292492/ | [email protected] | AdvisoryBundleRemedy |
| https://play.google.com/store/apps/details?id=jp.co.ticket | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wavedash Co., Ltd. Ticket Ryutsu Center | <= 4.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |