CVE-2026-5456 | Align Technology My Invisalign App 3.12.4 on Android com.aligntech.myinvisalign.emea BuildConfig.java CDAACCESS_TOKEN hard-coded key

A vulnerability has been found in Align Technology My Invisalign App 3.12.4 on Android and classified as problematic. The impacted element is an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea. The manipulation of the argument CDAACCESS_TOKEN leads to use of hard-coded cryptographic key
.

This vulnerability is listed as CVE-2026-5456. The attack must be carried out locally. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.