CVE-2026-5456

LOW

Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key

Title source: cna

Description

A vulnerability was identified in Align Technology My Invisalign App 3.12.4 on Android. The impacted element is an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The manipulation of the argument CDAACCESS_TOKEN leads to use of hard-coded cryptographic key . The attack must be carried out locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-355044 | Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key

https://vuldb.com/vuln/355044

Signature, Permissions Required signature permissions-required

VDB-355044 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/355044/cti

Third Party Advisory third-party-advisory

Submit #781763 | Align Technology My Invisalign(com.aligntech.myinvisalign.emea) 3.12.4 Contentful CDA Tokens Exposure

https://vuldb.com/submit/781763

Exploit exploit

https://www.notion.so/Contentful-CDA-Tokens-Exposure-Leading-to-Unauthorized-Access-to-Master-and-Release-Environments-in--3262de3f97fb802ebd1af88e1264cb9f?source=copy_link

Scores

CVSS v3 3.3

EPSS 0.0010

EPSS Percentile 1.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-320 CWE-321

Status published

Products (1)

Align Technology/My Invisalign App 3.12.4

Published Apr 03, 2026

Tracked Since Apr 03, 2026