CVE-2026-102666
Last modified
CVE-2026-102666 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Joyland | Joyland.ai | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-102666?
How severe is CVE-2026-102666?
How do I fix CVE-2026-102666?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-102638A maliciously crafted HTML payload in the description of an …7.1
- CVE-2026-102639MobilityDB version 1.3.0 and earlier contains an out-of-boun…6.5
- CVE-2026-10264A vulnerability was determined in lharries whatsapp-mcp 0.0.…3.5
- CVE-2026-102649Burrito is a Terraform Automation Collaboration Software (TA…9.9
- CVE-2026-10265A vulnerability was identified in itsourcecode Content Manag…6.3
- CVE-2026-102663OpenList is a file list program that supports multiple stora…4.3
- CVE-2026-102667Joyland AI app allows an attacker with shared network access…8.3
- CVE-2026-102668The Joyland AI app accepts any TLS certificates from any ser…5.3
- CVE-2026-102669Joyland AI app does not verify hostnames, allowing a malicio…5.3
- CVE-2026-10267A security flaw has been discovered in janet-lang janet up t…3.3
- CVE-2026-102670Joyland AI app explicitly permits cleartext HTTP traffic on …4.3
- CVE-2026-102671The Joyland AI app accepts invalid SSL certificates in the i…5.3
Are you affected by CVE-2026-102666?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST