CVE-2026-3668 Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control
Remote attackers can bypass access controls in the AndroidEthereum function of the dGEN1 mobile application, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-3668?
CVE-2026-3668 is a low-severity missing authorization vulnerability in Freedom Factory dGEN1, published on 7 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-3668?
How do I fix CVE-2026-3668?
No fix has been published for CVE-2026-3668 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3668 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3668 exists.
Sources
Also known as GHSA-mmqm-c3vq-cgvr.