The flaw stems from hardcoded usernames, passwords, and cryptographic keys embedded within the Schmooze mobile application. An attacker can decompile the delivered package, retrieve these secrets, and use them to authenticate to the backend services. Successful exploitation would let the adversary access protected backend and cloud resources, impersonate legitimate users, and forge API requests, potentially compromising sensitive user data and platform integrity.

Schmooze dating mobile Application, Android builds 5.2.7 and earlier, iOS builds 5.2.1 and earlier.

With a CVSS score of 9.3 this vulnerability is considered critical. The EPSS score is unavailable, indicating no current data on exploitation frequency, and it is not listed in the CISA KEV catalog. Nevertheless, the weakness is straightforward to exploit: an unauthenticated attacker can download the app, decompile it on any device or machine, extract the credentials and keys, and then use those to connect to the service. Because no authentication is required to start the attack, the potential for widespread compromise exists.