A vulnerability exists in the Android release of the Investory Toy Planet Trouble App up to version 1.5.5. The flaw lies in the assets file google‑services‑desktop.json, where manipulation of the current_key parameter results in the app using a hard‑coded cryptographic key. This exposes cryptographic material that could be used to decrypt stored data or forge authentication tokens. The weakness is associated with CWE‑320 (Use of Hard‑coded Cryptography) and CWE‑321 (Use of Predictably Generated Keys). The primary impact is a potential loss of confidentiality and integrity for user data stored or transmitted by the app.

The affected product is the Investory:Toy Planet Trouble App for Android, versions up to and including 1.5.5. The component specifically impacted is app.investory.toyfactory; no other vendors or products are listed.

The CVSS score of 4.8 indicates moderate severity. The exploit requires a local attack, meaning the attacker must have physical or local access to the device to modify the argument. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves local manipulation of the asset file, allowing an attacker to leverage the hard‑coded key to compromise data confidentiality and integrity.