The flaw exists in an undisclosed function of the com.meesho.supply component within the Meesho Online Shopping App. By manipulating the endpoint, an attacker can cause the app to use a risky cryptographic algorithm, exposing data to potential compromise. The vulnerability is classified as a cryptographic weakness (CWE‑310) and the use of an insecure algorithm (CWE‑327). This weakening permits a remote attacker to undermine encryption strength, potentially enabling data decryption or tampering with encrypted communication.

Android users of the Meesho Online Shopping App up to and including version 27.3 are affected. The vulnerability resides in the /api/endpoint of the com.meesho.supply component, but the exact function is not identified.

The CVSS score of 6.3 indicates moderate severity. Public disclosure has occurred, but the exploit is described as difficult and requiring high complexity. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the attack is remote and the cryptographic reduction could compromise confidentiality, it is recommended to treat the risk as significant and to apply a fix promptly.