A flaw has been identified in the BuildConfig.java file of the INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App that allows the manipulation of the ACCESS_KEY and HASH_KEY arguments. The manipulation of these arguments leads to the disclosure of hard‑coded credentials. This weakness corresponds to CWE‑259 and CWE‑798 and enables an attacker who can execute locally on the device to gain unauthorized access to backend services and potentially other protected resources.

The vulnerability affects the INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App on Android up to version 1.0.2. Users running any release of the app that includes the unpatched BuildConfig.java component are susceptible.

The CVSS score for this issue is 4.8, indicating a moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. However, the exploit is local only; therefore, an adversary who gains local execution privilege on the device can leverage the hard‑coded credentials to compromise the backend system.