CVE-2026-5453: Rico App Information Disclosure Vulnerability

CVE-2026-5453 Overview

CVE-2026-5453 affects the Rico investment Android application (br.com.rico.mobile) up to version 4.58.32.12421. The vulnerability resides in br/com/rico/mobile/di/SegmentSettingsModule.java, where the SEGMENT_WRITE_KEY argument is embedded as a hard-coded cryptographic key [CWE-320]. An attacker with local access to the application package can extract the key and abuse it to inject analytics data or manipulate user profiles via the Segment platform. The vendor was contacted before public disclosure but did not respond. The exploit details have been published and may be reused by other actors.

Critical Impact

Extraction of the embedded SEGMENT_WRITE_KEY enables unauthenticated data injection into the vendor's Segment analytics pipeline and tampering with downstream user profile records.

Affected Products

• Rico Mobile Android application package br.com.rico.mobile
• Versions up to and including 4.58.32.12421
• Component: br/com/rico/mobile/di/SegmentSettingsModule.java

Discovery Timeline

• 2026-04-03 - CVE-2026-5453 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-5453

Vulnerability Analysis

The Rico Android application bundles a Segment analytics write key directly inside the compiled APK. The key is referenced through the Dagger-style dependency injection module SegmentSettingsModule.java, which exposes the literal value at runtime. Any party able to read the APK on a local device can decompile the DEX bytecode and recover the credential. This is a classic hard-coded cryptographic key flaw classified under CWE-320 (Key Management Errors).

The issue is local-only and does not directly compromise device confidentiality or integrity. Its impact is on the integrity of telemetry and user profile data managed by the third-party Segment service rather than on the device or session itself.

Root Cause

The root cause is the inclusion of a long-lived analytics write key as a compile-time constant in source-controlled code. Because Android applications are distributed as decompilable artifacts, embedded secrets are recoverable with standard tooling such as apktool, jadx, or dex2jar. The application provides no runtime key retrieval, rotation, or attestation mechanism that would prevent reuse outside the legitimate client.

Attack Vector

An attacker installs the Rico APK on a controlled device or obtains the APK file from a public source. They decompile the package and locate the SEGMENT_WRITE_KEY string inside SegmentSettingsModule.java. With the key in hand, the attacker issues authenticated requests to Segment's tracking endpoints, injecting arbitrary identify and track events. This enables manipulation of user profile attributes, pollution of analytics data, and possible disruption of downstream personalization or fraud-detection workflows that consume the Segment pipeline.

The vulnerability is not remotely exploitable. Privileges required are limited to local access to the application binary. No verified proof-of-concept code is published in the references; technical details are described in the Notion Data Exposure Analysis and the VulDB Vulnerability #355041 entry.

Detection Methods for CVE-2026-5453

Indicators of Compromise

• Outbound HTTPS requests to api.segment.io/v1/track or api.segment.io/v1/identify originating from hosts other than legitimate mobile clients.
• Unexpected spikes in identify events tied to user IDs that do not correlate with active sessions.
• Profile attribute changes in the Segment workspace that were not triggered by an authenticated application flow.

Detection Strategies

• Audit the Segment workspace for use of the exposed write key and review event sources, IP ranges, and User-Agent strings.
• Correlate Segment ingestion logs with backend authentication logs to flag events without a matching user session.
• Static-analyze the deployed APK using jadx or apktool to confirm whether the key is still embedded in production builds.

Monitoring Recommendations

• Forward Segment audit logs and source telemetry into a centralized analytics or SIEM platform for anomaly review.
• Alert on event volumes per source that deviate from established baselines, particularly for identify calls that change PII fields.
• Track APK distribution channels for unauthorized rebuilds that may indicate broader abuse of the recovered key.

How to Mitigate CVE-2026-5453

Immediate Actions Required

• Rotate the exposed SEGMENT_WRITE_KEY in the Segment workspace and revoke the previous value.
• Remove the hard-coded key from SegmentSettingsModule.java and any version-controlled artifact, then rebuild and re-sign the APK.
• Block ingestion from the old key at the Segment source level until rotation is verified.

Patch Information

No vendor patch is referenced in the NVD entry. The vendor was contacted prior to public disclosure but did not respond, according to the VulDB Vulnerability #355041 record. Users of the Rico Android application should monitor the Google Play listing for updates beyond version 4.58.32.12421.

Workarounds

• Fetch the Segment write key at runtime from an authenticated backend endpoint tied to the user session rather than embedding it in the client.
• Apply server-side validation on incoming Segment events using a proxy that enforces user identity and rejects forged userId values.
• Enable Play Integrity API attestation so backend systems can reject telemetry from non-genuine clients before it reaches Segment.

# Configuration example - fetch analytics key at runtime instead of bundling it
# (replace hard-coded SEGMENT_WRITE_KEY with an authenticated lookup)
curl -X GET https://api.example-backend.internal/v1/analytics/key \
  -H "Authorization: Bearer ${USER_SESSION_JWT}" \
  -H "X-Device-Attestation: ${PLAY_INTEGRITY_TOKEN}"