A flaw in the BabyChakra Pregnancy & Parenting App (up to version 5.4.3.0) allows a local attacker to manipulate the SEGMENT_WRITE_KEY argument in Configuration.java, resulting in unprotected storage of credentials. The vulnerability is a Sensitive Data Exposure (CWE-255) and Unprotected Storage of Secrets (CWE-256). Because credentials are stored without encryption or integrity checks, they can be read by anyone with local access to the device, leading to potential credential compromise and subsequent misuse of user accounts or data. The vendor was notified but did not respond, and the exploit code is publicly available, indicating the flaw is reproducible and may be used in real attacks.

The affected product is the BabyChakra Pregnancy & Parenting App for Android, versions up to 5.4.3.0. The vulnerability resides in the app's Configuration.java file, specifically in an unknown function that handles the SEGMENT_WRITE_KEY argument.

The CVSS score is 2, indicating a low severity rating. The EPSS score is not available and the vulnerability is not listed in the KEV catalog. Exploitability is reported as difficult and requires local access, but the public release of exploit code increases the risk of exploitation. Overall risk is low but significant for devices where the app is installed and local access is possible.