EquityPandit 1.0 logs sensitive user credentials in plaintext during the forgot‑password flow. As a result, an attacker who can read the device’s developer console logs can acquire user passwords, undermining confidentiality and enabling account compromise. The vulnerability is a classic case of insecure credential storage and logging, classified as CWE‑612.

The affected product is EquityPandit version 1.0, a mobile application available on the Google Play store. No other versions are listed or known to be affected based on the current advisories.

The CVSS score of 8.7 indicates a high severity. Although an EPSS score is not provided, the attack requires access to the device via Android Debug Bridge, which typically requires the device to have debugging enabled or physical access. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. Nevertheless, the potential to harvest credentials is significant, and the attack vector is relatively straightforward once debugging is available.