CVE-2026-5682
LOWMeesho Online Shopping App com.meesho.supply endpoint risky encryption
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-5682. PoCs published by honestcorrupt.
AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-5682, an improper encryption vulnerability in the Meesho Android app. It highlights the use of AES-CBC without integrity protection and weak MD5-based key derivation, along with proof-of-concept steps for tampering with encrypted payloads.
Description
A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoint of the component com.meesho.supply. Such manipulation leads to risky cryptographic algorithm. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
Exploits (1)
This repository provides a detailed technical analysis of CVE-2026-5682, an improper encryption vulnerability in the Meesho Android app. It highlights the use of AES-CBC without integrity protection and weak MD5-based key derivation, along with proof-of-concept steps for tampering with encrypted payloads.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N