The vulnerability resides in the BuildConfig.java file of the My Invisalign App where a hard‑coded cryptographic key is used when processing the CDAACCESS_TOKEN argument. An adversary who can run code locally on an infected device could read or tamper with data that is encrypted with this key, resulting in potential disclosure or manipulation of sensitive information. The weakness corresponds to hard‑coded secrets and use of a hard‑coded encryption key.

The affected product is Align Technology’s My Invisalign App version 3.12.4 for Android, specifically the com.aligntech.myinvisalign.emea component. No other versions or platforms are listed as affected.

A CVSS score of 4.8 places the vulnerability in the moderate range, and the publicly available exploit suggests that an attacker who can run code on the device can take advantage of the hard‑coded key. Because the attack must be carried out locally, the threat is limited to devices that have already been compromised or are used by personnel who can execute code within the app. The lack of EPSS data and absence from the CISA KEV catalog indicate that the vulnerability has not yet been widely exploited, but the local nature does not eliminate the risk of data compromise if an insider or malicious user gains device access.