PT-2026-29990

CVE-2026-5456

Published

2026-04-03

Updated

2026-04-03

Description by

CVSS 3.1

3.3

Low

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Align Technology My Invisalign App version 3.12.4

Description A security issue exists in Align Technology My Invisalign App version 3.12.4 on Android. The issue involves the manipulation of the CDAACCESS TOKEN argument within an unknown function of the file com/aligntech/myinvisalign/BuildConfig.java of the component com.aligntech.myinvisalign.emea, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Fix

Researchers

Fxizenta

Vendors

Affected products

Weakness enumeration

CWE-321: Use of Hard-coded Cryptographic Key

CWE-320

Related identifiers