Vulnerability in Wahoo Fitness Systm App
CVE-2026-5462
A vulnerability was identified in Wahoo Fitness SYSTM App up to 7.2.1 on Android. Impacted is an unknown function of the file com/WahooFitness/SYSTM/BuildConfig.java of the component com.WahooFitness.SYSTM. Such manipulation of the argumen…
EPSS: 0.000 (1.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R.
Affected products
- Wahoo Fitness Systm App — versions 7.2.0, 7.2.1
Weakness classification (CWE)
References
- VDB-355053 | Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key (vdb-entry, technical-description)
- VDB-355053 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- Submit #781767 | Wahoo Fitness Wahoo SYSTM(com.WahooFitness.SYSTM) 7.2.1 Segment Write Key Exposure (third-party-advisory)
- www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Pro… (exploit)
Frequently asked questions
- What is CVE-2026-5462?
- CVE-2026-5462 is a low-severity vulnerability in Wahoo Fitness Systm App, classified under Use of Hard-coded Cryptographic Key. CVSS score: 3.3/10. Published 2026-04-03.
- How severe is CVE-2026-5462?
- Low severity. CVSS v3 base score is 3.3 out of 10.