CVE-2025-59406 Hardcoded credentials in n/a

Medium 6.2 Published 2 Oct 2025 Updated 2 Oct 2025

Attackers can extract hardcoded OAuth secrets from the Android app binary, potentially bypassing authentication and accessing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-59406?

CVE-2025-59406 is a medium-severity vulnerability in n/a, published on 2 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.

Weakness: CWE-319

Which versions are affected by CVE-2025-59406?

It affects 1 product.

Products include Flocksafety Flock Safety.

How do I fix CVE-2025-59406?

No fix has been published for CVE-2025-59406 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-59406 being exploited?

There is no known exploitation of CVE-2025-59406 in the wild and no public exploit code.

Sources

Also known as GHSA-34xp-hg92-v4qh.