CVE-2026-5462 | Wahoo Fitness SYSTM App up to 7.2.1 on Android com.WahooFitness.SYSTM BuildConfig.java SEGMENT_WRITE_KEY hard-coded key

A vulnerability described as problematic has been identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfig.java of the component com.WahooFitness.SYSTM. Such manipulation of the argument SEGMENT_WRITE_KEY leads to use of hard-coded cryptographic key
.

This vulnerability is uniquely identified as CVE-2026-5462. Local access is required to approach this attack. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.