An unknown function in the file jRwTX.java of cats.goods.sort.sorting.games accepts a manipulated AES_IV/AES_PASSWORD argument, causing the application to fall back to a hard‑coded cryptographic key. This flaw exposes a predictable key that can be used by an attacker with local access to decrypt data or forge authentication tokens, thereby compromising confidentiality of stored assets and potentially broader system data if the key is reused elsewhere.

The vulnerability affects Shinrays Games Goods Triple App versions up to and including 1.200. The issue resides in the component cats.goods.sort.sorting.games, specifically the jRwTX.java source file.

With a CVSS score of 2.0 the flaw is considered low severity. Exploitation requires local user privileges and is described as difficult, however publicly available code exists. The vulnerability is not listed in CISA's KEV catalog and no EPSS score is available, indicating limited automated exploitation evidence. The local attack requirement reduces the attack surface but still presents a risk for compromised or malicious local users.