A vulnerability exists in the myAEDES App, specifically within the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. By manipulating the argument AUTH_KEY, an attacker can read sensitive data that should not be exposed. This results in information disclosure with potential integrity impact on data confidentiality. The weakness corresponds to CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). The exploit is categorized as high complexity and difficult to execute, but the attack surface is limited to local system access only.

The affected product is myAEDES App with all releases up to version 1.18.4 on Android devices. No specific vendor sub‑versions are listed; the vulnerability is reported in the generic "myAEDES App" product family.

The CVSS score is 2, indicating low overall severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, high attack complexity, and privileged execution, making it unlikely that an attacker can leverage it remotely or in the absence of local host compromise.