CVE-2026-16581 Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application
Attackers can extract sensitive data from the mobile app source code to access unprotected backend services and functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-16581?
CVE-2026-16581 is a medium-severity vulnerability in igloohome Smart Lock Mobile Application, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.
Weakness: CWE-540
Which versions are affected by CVE-2026-16581?
How do I fix CVE-2026-16581?
No fix has been published for CVE-2026-16581 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16581 being exploited?
There is no known exploitation of CVE-2026-16581 in the wild and no public exploit code.
Sources
Also known as GHSA-r8jp-hxqx-9x6c.