Due to the logging of authentication tokens for debugging purposes, the iRA 2.0 and iRA.ev mobile applications expose active session tokens in local log files. A local attacker who can read these logs can retrieve the credentials and impersonate the legitimate user, gaining unauthorized access to vehicle data and services. This vulnerability enables an attacker to compromise confidentiality and integrity of user sessions by exploiting improper handling of authentication tokens (CWE‑532).

The vulnerability affects Tata Motors iRA 2.0 and iRA.ev mobile applications. Version 26.7.3 or earlier of iRA 2.0, and version 26.7.2 or earlier of iRA.ev are impacted. The defect is resolved in iRA 26.8.2 and iRA.ev 26.9.1, which should be installed.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not available, meaning no current exploitation data. The vulnerability is not listed in CISA KEV, so there are no known mass exploitation cases. Attack requires local access to the device or its logs; an attacker must read the application’s log files to capture the exposed tokens. Once obtained, those tokens can be reused to access vehicle services and telemetry, effectively bypassing authentication controls. Because restrictions on log access are not enforced, the likelihood of exploitation depends on whether an attacker can obtain file‑system permissions on the device.