CVE-2026-102666: Joyland AI hard-coded credentials for push notifications

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-07
Weakness: CWE-798

Description

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.

Affected products

Joyland.ai: all versions

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/VA-26-275-03.json
https://www.cve.org/CVERecord?id=CVE-2026-102666

Get alerted when CVE-2026-102666 or the next vulnerability affects your stack