The vulnerability allows an attacker with local access to manipulate the credentials.json file located in the file resources/assets/flutter_assets/assets/credentials.json of the ai.citydata.citychat component of CityData CityChat. This results in unprotected storage of credentials, effectively exposing sensitive authentication information. The weakness is identified as CWE-255 (Plaintext Storage of Sensitive Information) and CWE-256 (Improper Restriction of Default Permissions). The primary impact is disclosure of credentials, potentially allowing further unauthorized access to services tied to those credentials. The attack is difficult to execute and requires a high level of complexity, but because the exploit is publicly disclosed it remains a concern for devices that have not been patched or do not enforce strict local access controls.

CityData CityChat versions up to 0.12.6 running on Android are affected. The exact list of affected versions is not explicitly provided in the source information. The product vendor is identified as CityData, and the component in question is ai.citydata.citychat.

The CVSS score of 2 indicates a low severity rating. EPSS information is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires local access and a high complexity level, making exploitation difficult, but the public disclosure of the exploit means it could be used opportunistically on vulnerable devices. Consequently, the overall risk is low to moderate, but the confidentiality impact warrants deferral until an official fix or alternative mitigation can be applied.