FOD App Hard-Coded Cryptographic Keys Vulnerability

A vulnerability exists in the FOD app for Android and iOS, both in versions prior to 5.2.0, due to the use of hard-coded cryptographic keys. This flaw may allow a local, unauthenticated attacker to retrieve these keys, which are utilized in processing JSON Web Token (JWT) data. While the developer claims that the impact is minimal—stating that, under normal circumstances, it is unlikely to lead to account impersonation—the existence of these keys still poses a potential risk.

Impact

The hard-coded keys could be extracted by an attacker. Although the developer believes this risk is limited, as the keys were invalidated on November 17, 2025, and communications using them are no longer possible, the vulnerability could still have allowed for key retrieval prior to this date.

Remediation

Users are advised to update the FOD app to version 5.2.0 or later, available on both Android and iOS. The developer has ensured that the affected versions will prompt an automatic update.