A vulnerability in the HeyCyan App 1.0.103 on Android allows an attacker to force cleartext transmission of potentially sensitive data by manipulating the Network Security Configuration component referenced in the AndroidManifest.xml. This weakness is due to inadequate configuration that permits insecure traffic, resulting in the exposure of confidential information. The impact is a confidentiality compromise, as data can be intercepted in clear text across the network.

HeyCyan App version 1.0.103 running on Android devices is affected. The flaw originates from an unknown function within the app’s AndroidManifest.xml that configures network security. Only the stated version is known to be susceptible; newer or older releases may not be impacted unless they contain the same configuration bug.

The CVSS score of 6.3 indicates moderate severity, and the lack of an EPSS score makes the current exploitation probability uncertain. The vulnerability can be triggered remotely, but the description notes a high level of complexity and difficult exploitability, suggesting that an adversary would need significant resources or custom tooling. The flaw is not listed in CISA’s KEV catalog, reducing evidence of widespread active exploitation reports. Nevertheless, the combination of remote attack potential and cleartext leakage poses a non‑negligible risk to users who may transmit sensitive information over the app.