Align Technology My Invisalign 3.12.4 Hardcoded Contentful CDA Token Exposure

Vulnerability Summary Vulnerability Overview Align Technology's My Invisalign app (version 3.12.4) contains a Contentful CDA Tokens exposure vulnerability. The app hardcodes Contentful Delivery API credentials (space ID and CDA token) in its client-side code. Attackers can leverage these credentials to directly query the Contentful CDA API, enabling unauthorized access to all entries in both the master production and release (pre-production) environments. This leads to the exposure of sensitive business configuration data, marketing strategies, multilingual translations, and help documentation. Impact Scope Application Name: Align Technology My Invisalign (com.aligntech.myinvisalign.emea) Affected Version: 3.12.4 Affected Environments: Master Production and Release Pre-Production Exposed Data: Sensitive business configuration data, marketing strategies, multilingual translations, help documentation Remediation The page does not provide specific fix code. Typically, hard-coded API keys should be removed and replaced with environment variables or secure key management services for storing sensitive credentials. POC / Exploitation Code No complete exploit script is provided directly, but the leaked credentials are located in the file, specifically the field. Related Links Source**: https://www.redos.io/contentful-cda-tokens-exposure-leading-to-unauthorized-access-to-master-and-release-environments-in-20260397817682ed4a18f1e126469f80ucp-n0zcy_link

Goal Reached Thanks to every supporter — we hit 100%!

Align Technology My Invisalign 3.12.4 Hardcoded Contentful CDA Token Exposure