CVE-2026-9221: Setracker2 Android App Auth Bypass Flaw

CVE-2026-9221 Overview

CVE-2026-9221 affects the Setracker2 Android Companion App (com.tgelec.setracker) in versions 3.1.5 and earlier. The application relies on the MD5 hash function to generate request signatures that authenticate communications between the mobile client and the backend REST API. Attackers can reverse the signature to recover the session ID used in authenticated requests. Once the session ID is exposed, attackers can impersonate legitimate users and issue authenticated API calls. The weakness maps to [CWE-327] Use of a Broken or Risky Cryptographic Algorithm.

Critical Impact
Reversal of the MD5-based signature exposes session identifiers, enabling full account impersonation over authenticated REST API calls.

Affected Products

Setracker2 Android Companion App (com.tgelec.setracker) version 3.1.5
All prior versions of com.tgelec.setracker below 3.1.5
Backend REST API endpoints consuming the MD5-signed session tokens

Discovery Timeline

2026-06-26 - CVE-2026-9221 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-9221

Vulnerability Analysis

The Setracker2 companion app authenticates REST API traffic using a request signature derived from MD5. MD5 is a broken hash algorithm that offers insufficient collision and preimage resistance for authentication use cases. The app embeds the session ID within the material that is hashed, and the signature is transmitted alongside each request. An attacker who captures signed traffic can perform offline analysis to recover the input material, including the session ID. With a valid session ID, the attacker can craft their own signed requests and issue them to the backend as the victim user. The impact is confined to confidentiality of user data accessible through the API, consistent with the CVSS vector indicating high confidentiality impact but no integrity or availability effects.

Root Cause

The root cause is the use of MD5 as the signing primitive for session authentication material. MD5 does not provide the cryptographic strength required to protect a shared secret or session identifier included in the hashed input. The design choice conflates hashing with authenticated signing, omitting a keyed construction such as HMAC with a modern hash function.

Attack Vector

The attack proceeds over the network without authentication or user interaction. An attacker who observes or replays signed API traffic performs offline reversal against the MD5 signature to recover the embedded session ID. The attacker then constructs new API requests, computes valid signatures, and submits them to the backend. The backend accepts the requests as coming from the legitimate account holder, exposing account data and account-scoped operations.

No verified proof-of-concept code has been published. See the CISA CSAF Vulnerability Assessment for the authoritative technical description.

Detection Methods for CVE-2026-9221

Indicators of Compromise

API requests from a single session ID originating from multiple distinct IP addresses or geolocations within a short window
Reuse of the same MD5 signature across requests that should carry unique per-request values
Client User-Agent strings that do not match the official com.tgelec.setracker Android build fingerprint
Spikes in authenticated API calls to account-data endpoints outside normal user activity windows

Detection Strategies

Instrument the backend REST API to log the tuple of session ID, source IP, device identifier, and signature, and alert on divergence between fields historically bound together
Correlate authentication events with device attestation data to flag sessions used from unexpected clients
Apply anomaly detection on per-session request rate and endpoint diversity to catch scripted impersonation traffic

Monitoring Recommendations

Forward REST API access logs to a centralized analytics platform for long-window session behavior analysis
Monitor for signature collisions or repeated signature values across differing request bodies
Track failed and successful account-data reads per session and alert on abrupt increases

How to Mitigate CVE-2026-9221

Immediate Actions Required

Upgrade the Setracker2 Android Companion App beyond version 3.1.5 once a vendor-fixed release is available
Invalidate existing session IDs server-side and require re-authentication across the user base
Rate-limit and geofence authenticated REST API endpoints to constrain impersonation attempts
Enforce TLS certificate pinning on the mobile client to reduce exposure of signed traffic to interception

Patch Information

No vendor patch reference was published in the CVE record at the time of writing. Refer to the CISA CSAF Vulnerability Assessment for vendor coordination status and any subsequent updates from the application publisher.

Workarounds

Replace MD5 signing with an HMAC construction using SHA-256 or stronger, keyed with a per-installation secret provisioned at first launch
Bind session IDs to device fingerprint and source network attributes and reject requests that violate that binding
Shorten session lifetimes and rotate session IDs on privilege-relevant actions to reduce the value of a recovered identifier

bash

# Example server-side hardening: enforce HMAC-SHA256 signature verification
# and reject legacy MD5-signed requests
if [ "$SIGN_ALG" = "md5" ]; then
  echo "reject: deprecated signature algorithm" >&2
  exit 1
fi
expected=$(printf '%s' "$REQUEST_BODY" | openssl dgst -sha256 -hmac "$SESSION_KEY" | awk '{print $2}')
[ "$expected" = "$CLIENT_SIGNATURE" ] || { echo "reject: invalid signature" >&2; exit 1; }