The vulnerability allows an unauthorised party to generate valid physical access QR codes because the application contains hard‑coded credentials. The QR generation mechanism uses the 'badge_number' parameter as the HMAC private key, which remains static and is exposed through the API endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. Because the APK is not obfuscated, an attacker can reverse engineer the cryptographic implementation to create any QR code that will grant entry, even after the victim changes their password or logs out.

The affected product is Virtuagym by Resamania. No specific versions are listed in the CNA data, so all current installations that include the unprotected QR generation API are potentially vulnerable.

The CVSS score of 8.6 indicates high severity, and the EPSS score is not available, but the weakness is not listed in the CISA KEV catalog. Attackers need only discover the static key via the exposed API and reverse engineer the cryptographic logic, which is straightforward because the APK lacks obfuscation. Once they have the key, they can generate unlimited legitimate QR codes, enabling unauthorized physical access to facilities.