{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Jericho C. Gregory"
        ],
        "summary": "reported this vulnerability to CISA."
      }
    ],
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "China",
        "title": "Company headquarters location"
      },
      {
        "category": "other",
        "text": "None",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Successful exploitation of this vulnerability could allow an attacker to obtain sensitive account credentials and identity information.",
        "title": "Advisory Summary"
      },
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "VA Advisory VA-26-225-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-225-01.json"
      }
    ],
    "title": "Yarbo iOS Mobile Application",
    "tracking": {
      "current_release_date": "2026-08-13T06:00:00.000000Z",
      "generator": {
        "date": "2026-07-29T16:46:08.831496Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "2.0.0"
        }
      },
      "id": "VA-26-225-01",
      "initial_release_date": "2026-08-13T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2026-08-13T06:00:00.000000Z",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "<3.19.0",
                "product": {
                  "name": "Yarbo iOS Mobile Application <3.19.0",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Yarbo iOS Mobile Application"
          }
        ],
        "category": "vendor",
        "name": "Yarbo"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18254",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "involvements": [
        {
          "date": "2026-07-20T06:00:00.000000Z",
          "party": "vendor",
          "status": "completed",
          "summary": "Vendor has provided a patch for the vulnerability."
        }
      ],
      "notes": [
        {
          "category": "summary",
          "text": "On user login, the Yarbo iOS application writes sensitive authentication data in plaintext to the iOS system log. This data is accessible to any computer the device has previously trusted, using built-in operating system tooling without special access or configuration. An attacker with brief physical access to an unlocked device could harvest these credentials and use them to access the user's registered devices, obtain account identity information, or conduct targeted account-based attacks.",
          "title": "Vulnerability Summary"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/2026-07-29T16:46:08.834103Z",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18254"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/532.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Yarbo recommends users update their app to at least version 3.19.0, which has resolved this vulnerability.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Yarbo recommends users reset previously established trust relationships with paired computers (Settings > General > Transfer or Reset iPhone > Reset > Reset Location & Privacy).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Yarbo urges users to not trust unfamiliar computers when prompted after connecting via USB. Enable a device passcode and keep the device locked when unattended.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}