Schmooze dating app: Hardcoded credentials and cryptographic keys in client
Summary
The Schmooze mobile dating app ships with hardcoded credentials and cryptographic keys in its client package. An unauthenticated remote attacker can decompile the distributed Android or iOS app, extract these secrets, and use them to gain unauthorized access to backend and cloud resources and to forge client requests. No user interaction is required.
Affected
- Android: Schmooze 5.2.7 (build 452) and prior
- iOS: Schmooze 5.2.1 and prior
- Default iOS status in one database record is marked unaffected, which contradicts the listed affected versions; CERT-In version ranges are used here
Fixed in
- Android: 5.2.8 or later
- iOS: 5.2.2 or later
Workaround
- Unknown. No workaround is documented in the reviewed sources; the only remedy is the app update.
Exploitation
- No reports of exploitation in the wild found, no public proof of concept found, not listed in KEV (absence of evidence in the searches performed).
- CISA SSVC: Automatable yes, Technical Impact partial.
Our recommendation
- Ask staff whether the Schmooze app is installed on company-managed or BYOD devices and update it to the fixed versions.
- Check that your own mobile apps and the APIs they call do not embed secrets or keys.
- Ask the vendor whether embedded credentials and keys were rotated on the backend, since updating the app does not revoke secrets already shipped in older builds.
- Monitor the CERT-In advisory and the vendor store listings for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT-In CIVN-2026-0489 www.cert-in.org.in
- VulDB CVE-2026-85153 vuldb.com
- Strix CVE-2026-85153 www.strix.ai
- Threatint CVE-2026-85153 cve.threatint.com
- Google Play Schmooze listing (en_IN) play.google.com
- Aptoide Schmooze schmooze.en.aptoide.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:23.
Original description (NVD)
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and cryptographic keys. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to backend and cloud resources and forge client requests on the targeted system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.