A hard‑coded cryptographic key is stored in the file res/raw/config.json of the ca.diagram.dialogue component of Dialogue App. Manipulating the SEGMENT_WRITE_KEY argument allows local code to activate this hard‑coded key, exposing weaknesses identified as CWE-320 and CWE-321. This can enable data injection or unauthorized user‑profile manipulation on the device where the app runs.

The flaw affects Dialogue App version 4.3.2 and earlier on Android devices. No other vendors, products, or versions are documented as impacted.

The CVSS score of 4.8 reflects moderate severity. Exploitation requires local execution; remote attackers cannot reach the vulnerability directly. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. While the vulnerability is publicly disclosed, only users or malicious applications on the same device can exploit it, limiting its broader threat but still posing a significant risk to device‑owner data.