CISA published an ICS advisory for the igloohome Smart Lock Mobile Application (Android) version 3.2.3 and prior, tracking CVE-2026-16581 (CVSS v3 5.3). The flaw stems from inclusion of sensitive information in the app’s source code, which could allow an unauthorized actor to access backend functions or services that lacked sufficient authentication controls.
The core issue is an access-control/credential exposure problem: secrets baked into a mobile client can be extracted and abused to bypass authentication against server-side APIs. The vendor has since strengthened access controls on its backend services to ensure only authorized parties can reach the affected functions.
What to take away: hardcoded credentials or keys in client applications remain a recurring identity weakness—authentication and authorization must be enforced server-side, never presumed from a trusted client. Organizations deploying these smart locks should update to the fixed version and treat any embedded secrets as compromised.