Girafit camera app for Android and iOS, version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded TURN relay username and session token. An attacker can obtain these credentials by decompiling the application or by intercepting unencrypted live view registration traffic. Because the credentials are identical across all installations and not tied to individual users or devices, the disclosure enables tracking, impersonation, or further exploitation if combined with the TURN relay password.

This vulnerability affects Girafit Camera App for Android and iOS up to and including version 1.9.1, as well as the premade Girafit camera devices that ship with this firmware. All installations share the same hardcoded credentials; no additional versions are listed beyond 1.9.1.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can easily extract the credentials by decompiling the application package (APK/IPA) or by observing live view registration traffic that is sent in clear text. Because the extraction requires no special privileges and the credentials are shared globally, the exploitation path is straightforward, making the risk moderate to high if mitigations are not applied.