News, updates, trends and the latest
info you need to know about IT

Overview
Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity.
Description
BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application.
VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks.
VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata.
VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous.
Impact
Impacts of successful exploitation vary by vulnerability.
VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft.
VU#124705.2: An attacker can locate the public RevenueCat SDK key and query the RevenueCat API using arbitrary phone numbers to retrieve associated user metadata, including activity and purchase history.
VU#124705.3: The personal data, or PII, of other users, intended to be anonymous, can be accessed through local system logs. The application’s backend sending other users’ MSISDNs to the client in any capacity presents a privacy violation.
These vulnerabilities have been confirmed against Basechat – Audio Dating App, Android version 9.8.1.
Solution
Unfortunately, Mobile Trading GmbH, the owners of BaseChat, could not be reached to coordinate this vulnerability.
Acknowledgements
Thanks to Mahmoud Ali Khan for reporting these vulnerabilities. This document was written by Alex Lewis.

Overview
INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5.
Description
INFINITT PACS is an enterprise web-based medical imaging platform that stores, retrieves, and displays patient scans.
CVE-2026-16305
An improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved.
SmartExecute.exe reads and runs commands from execlist.txt after an update. Because of insecure file permissions on execlist.txt, a low-privileged attacker can modify the file before it is processed to add arbitrary malicious commands. After SmartUpdate.exe launches, it runs SmartExecute.exe and the user can be prompted by User Account Control (UAC), which can allow the malicious command to execute with administrative privileges.
CVE-2026-16306
An unsafe command dispatch through the registered imodular:// URI scheme may result in code execution.
A vulnerability in IModular.exe allows an attacker to execute certain application functions by supplying a crafted imodular:// link. The application reads the cmd value from the link and executes the corresponding function without verifying that the command is permitted or safe. By convincing an end user to open a crafted imodular:// link, an attacker can cause IModular.exe to access attacker-controlled files or run specific programs from a local folder or network share. The link also accepts a url parameter that causes IModular.exe to connect to an attacker-controlled SignalR endpoint, creating an unauthorized outbound connection.
Impact
Successful exploitation of CVE-2026-16305 may allow a local, low-privileged attacker to execute arbitrary commands with administrative privileges on the affected workstation. An attacker could then install or modify software, access protected files, disable security controls, or establish persistent access to the system.
Successful exploitation of CVE-2026-16306 may allow a remote attacker to execute code with the privileges of the affected user, access or modify data available to that user, and use the compromised workstation as a foothold for further attacks. The vulnerability may allow unauthorized outbound communication with an attacker-controlled SignalR server, potentially exposing sensitive information or enabling additional malicious activity.
Solution
There are no indications that these vulnerabilities have been exploited. INFINITT Healthcare recommends upgrading affected installations to one of the following fixed System Manager versions:

System Manager 3.0.12.3
System Manager 3.0.12.5

Organizations should apply the appropriate update as soon as operationally feasible.
Acknowledgements
Thanks to Piotr Berlinski from CyberArms.io for identifying these vulnerabilities, and to INFINITT for quickly addressing the problems. This document was written by Michael Bragg.

Overview
Fireblocks’ mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from.
After reviewing the feedback from Fireblocks and further analysis of the case, we have determined that this does not constitute a valid vulnerability. Fireblocks clarified that mpc-lib’s signing protocols use only non-hardened BIP32 derivation and that a hardened index is handled as a non-hardened one. Effective exploitation would require privileged access, at which point the attacker would already hold the master share, rendering the issue moot.
Description
Fireblocks is a digital-asset custody and wallet platform that secures the private keys behind cryptocurrency wallets for institutions and exchanges, using multi-party computation (MPC) so that no single machine ever holds a complete key.
Fireblocks’ key security pipeline contains two layers: MPC, which splits a single key into shares, and hardened derivation, which mathematically isolates each share from its key hierarchy. Normally, the derivation delta between parent and child keys is formed by hashing the private parent key, a derivation index, and associated metadata.
VU#701544.1
A fail-open vulnerability was identified within the BIP32 hardened derivation implementation which fails to reject operations where no parent secret is present. If a parent key is missing, the implementation substitutes the secret parent contribution with a null buffer. Because the buffer becomes a known constant, 0, the delta becomes computable, violating ancestor isolation.
Impact
An attacker who compromises a single MPC party’s descendant signer share, and who knows the associated chain code, can compute the public derivation delta and subtract it to recover that party’s ancestor share, repeating the operation up the hierarchy to obtain that party’s root share. The isolation between derivation levels is reduced to a publicly computable scalar, so a single leaf-level share compromise extends to that party’s shares across the entire key hierarchy managed by the MPC cluster.
The primary MPC secret-sharing layer still prevents reconstruction of a full private key from a single compromised party’s shares, so this flaw does not by itself yield a spendable key. Its significance is the elimination of a defense-in-depth layer: hardened derivation no longer provides post-compromise ancestor isolation, threshold-security assumptions degrade as compromise propagates across derivation levels over time, and the downgrade occurs silently with no error or log signal. In BIP32 deployments where the chain code is treated as public, the precondition of knowing the chain code is trivially met.
Solution
At the time of writing, Fireblocks could not be reached to coordinate this vulnerability, and no vendor fix is available. Integrators can, however, reduce exposure with the following mitigations.

Treat the chain code as secret. The attack is only available to a party that knows the chain code, because the derivation delta is computed as HMAC-SHA512(chaincode, …). Chain codes should not be distributed in watch-only extended public keys or otherwise exposed to untrusted parties. Where a deployment can keep the chain code confidential, the delta is no longer publicly computable and ancestor-share recovery is not possible. This is the most effective mitigation available without a code change.

Do not rely on hardened derivation for isolation between signer shares. Audit derivation paths for hardened segments and treat the compromise of any single share as potentially exposing that party’s other shares across the derivation hierarchy.

A complete fix requires a change in the library.
Acknowledgements
Thanks to hodlturk for reporting this vulnerability. This document was written using AI assisted tools by Alexander Curtis and Alex Lewis.