Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain hardcoded TURN relay credentials that can be extracted by decompiling the app or intercepting unencrypted live view registration traffic. By obtaining the shared TURN relay username and session token, which are uniform across all installations and not tied to any user or device, an attacker could track devices, impersonate them, or combine the disclosed credentials with the TURN relay password for further exploitation. This vulnerability effectively exposes authentication credentials used for real‑time communication services.

The vulnerability affects Girafit Camera App for Android and iOS up to and including version 1.9.1, as well as the premade Girafit camera devices that ship with this firmware. All installations share the same hardcoded credentials; no additional versions are listed beyond 1.9.1.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. Because the credentials are embedded in application code and network traffic is transmitted in clear text, the attack path is straightforward: an adversary who can decompile the APK/IPA or observe the live view handshake can obtain the TURN username and session token. The vulnerability is not listed in the CISA KEV catalog, but the low complexity of extraction makes it potentially exploitable without advanced expertise. Operators should treat the exposure as a moderate risk pending a vendor fix.