The vulnerability is a CWE‑798 hard‑coded credential flaw. The Joyland AI application embeds static credentials for the GeTui push‑notification service, enabling an adversary to call the GeTui REST API directly. By doing so an attacker can craft and dispatch arbitrary push messages to any single user, a group of users, or all users of the platform. While the capability does not provide direct code execution on the device or host, it can be leveraged for phishing, misinformation, or spam campaigns that reach a broad audience.

The affected product is Joyland.ai provided by Joyland. No specific version or build information is disclosed in the CVE entry, and therefore the scope may apply to all releases that have not been patched to remove the hard‑coded credentials.

The credential exposure is evaluated at a CVSS score of 6.9, indicating medium severity. The EPSS score is not disclosed, and the CVE is not present in CISA’s KEV list. Attackers would obtain access by exploiting the exposed credentials, a path that requires network connectivity to the GeTui service but no additional user interaction. Once authenticated, the attacker can send arbitrary content at will, making the vulnerability a functional vector for social‑engineering or broad‑scale spam. Overall, the risk is moderate, but the potential for widespread impact warrants timely remediation.