CVE-2026-102666: Joyland Joyland.ai

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once.

Affected products

• Joyland Joyland.ai: any version

Published 2026-10-01. Last modified 2026-10-07.