CVE-2026-12587 Overview
CVE-2026-12587 is a hard-coded credentials vulnerability [CWE-798] affecting the Virtuagym mobile application. The flaw allows attackers to generate valid physical access QR codes without authorization. The application uses the static badge_number parameter as the HMAC private key for QR code generation. This value is retrievable through the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info. Because the Android APK ships without code obfuscation, attackers can reverse engineer the cryptographic logic and forge QR codes indefinitely. Generated codes remain valid even after the affected user changes their password or logs out.
Critical Impact
Attackers who obtain a member's badge_number can generate unlimited valid physical access QR codes, bypassing gym access controls and persisting beyond password resets.
Affected Products
- Virtuagym mobile application (Android APK)
- Resamania QR code integration endpoint
- Physical access control systems relying on Virtuagym-issued QR codes
Discovery Timeline
- 2026-08-26 - CVE-2026-12587 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-12587
Vulnerability Analysis
The vulnerability resides in the QR code generation mechanism of the Virtuagym application. The application computes an HMAC using the badge_number field as the private key. A private key is meant to remain confidential, but badge_number is a static identifier exposed through an authenticated API call to /club/_id_club_/member/_id_member_/resamania_qr_info. Any actor who reads this value gains persistent forgery capability against the affected account.
The issue is compounded by the absence of code obfuscation in the Android APK. An attacker can decompile the application, extract the HMAC construction routine, and replicate the QR code generation offline. Once the algorithm and the badge_number are known, forged QR codes remain valid regardless of session state, password changes, or logout events.
Root Cause
The root cause is the misuse of a low-entropy, static identifier as a cryptographic secret. The badge_number was designed as an account reference, not a key. Combining hard-coded credential logic [CWE-798] with an unobfuscated client and no server-side rotation produces a permanent authentication bypass primitive tied to the badge value.
Attack Vector
An authenticated attacker with low privileges queries the resamania_qr_info endpoint to retrieve the target badge_number. The attacker then reverse engineers the APK to extract the HMAC generation function. Using the recovered algorithm and the static badge value, the attacker generates valid QR codes for physical access at will. Revoking user sessions or credentials does not invalidate previously derived QR codes because the key material itself does not rotate.
See the INCIBE Security Notice for the coordinating advisory.
Detection Methods for CVE-2026-12587
Indicators of Compromise
- Repeated or automated requests to the /club/{id_club}/member/{id_member}/resamania_qr_info endpoint from a single session.
- Physical access events for a member occurring at anomalous times or from geographically inconsistent locations.
- QR code scan patterns showing identical badge activity following a password reset or account recovery event.
Detection Strategies
- Correlate API access logs for resamania_qr_info calls with subsequent physical access events to flag mismatches.
- Monitor mobile client integrity by tracking device attestation and detecting unofficial or repackaged APK builds.
- Alert on physical access badge use that continues after a credential rotation or session termination.
Monitoring Recommendations
- Enable verbose logging on the QR verification service, capturing timestamp, badge number, and originating access point.
- Ingest access control and application API telemetry into a centralized data lake for cross-source correlation.
- Establish baselines for QR scan frequency per member and alert on deviations that suggest scripted forgery.
How to Mitigate CVE-2026-12587
Immediate Actions Required
- Rotate the QR code signing scheme to use a server-held secret unrelated to any user-visible identifier.
- Restrict access to the resamania_qr_info endpoint and enforce short-lived tokens rather than static badge values.
- Invalidate previously issued QR codes and require reissuance through an authenticated flow.
Patch Information
At the time of publication, no vendor patch identifier has been listed in the NVD entry for CVE-2026-12587. Refer to the INCIBE Security Notice for vendor coordination status and follow Virtuagym communications for remediation releases.
Workarounds
- Implement time-bound QR codes with server-side expiration to limit the window of forged code validity.
- Add code obfuscation and integrity checks to the mobile client to raise the cost of reverse engineering.
- Enforce secondary verification at access points, such as device presence checks or badge revocation lists synchronized in near real time.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
