A weakness in La Nacion App 10.2.25 allows manipulation of the argument API_KEY_WEBSOCKET_CV within BuildConfig.java to cause unprotected storage of WebSocket API keys. The exposure of these credentials results in confidentiality loss; an attacker could potentially use the leaked keys to establish unauthorized WebSocket connections to the app’s backend. Based on the description, it is inferred that possession of these keys could enable further malicious activities, such as data exfiltration or unauthorized access to services, although the CVE itself does not explicitly document these downstream effects.

The affected system is La Nacion App version 10.2.25 running on Android devices. The vulnerability resides in an unknown function of source/app/lanacion/clublanacion/BuildConfig.java within the app.lanacion.activity component. No other vendors or product versions are listed as affected, and the vendor did not issue a public fix.

The CVSS score is 2, indicating low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can only be executed locally, requires high complexity, and is considered difficult to perform; however, exploit code has already been made public. While the overall risk is low to moderate, local device access would grant an attacker sensitive credentials that could be leveraged for further attacks. The lack of an official patch heightens the importance of mitigating the credential leakage proactively.