GeoVision's GV-Face facial recognition software transmits user credentials and related authentication data over unencrypted HTTP connections, a flaw that has been given the maximum possible severity score of 10.0 out of 10. The vulnerability, tracked as CVE-2026-124600, was published on 10 November 2026.

Because the traffic is not encrypted, anyone able to intercept network traffic between the software and its server can read the credentials as they pass across the network. The flaw is classed as cleartext transmission of sensitive information, and its CVSS 4.0 vector records network attack access with low complexity, no privileges required and no user interaction needed.

Why a 10.0 score matters

A score of 10.0 is the highest a vulnerability can receive. It reflects that the flaw is remotely reachable, easy to exploit and can compromise the confidentiality, integrity and availability of the affected system, including data beyond the vulnerable component itself. Facial recognition systems handle biometric and identity data, so exposed credentials could give an attacker a route into systems that control physical access.

GeoVision has published a security advisory on the issue, which is referenced in the CVE record. The advisory is the authoritative source for affected versions and the fix, and operators of GV-Face should consult it directly rather than relying on summaries.

No exploitation reported yet

There are no reports of the flaw being exploited in the wild, no public exploit code is known, and the vulnerability does not appear in the US CISA Known Exploited Vulnerabilities catalogue. That is no reason to delay: cleartext credential flaws are straightforward for an attacker positioned on the same network to abuse, and the exposure exists from the moment the software is used on an untrusted or shared network.

The weakness is classified as CWE-319, cleartext transmission of sensitive information. In practice, that means the login details are sent in readable form rather than inside an encrypted channel, so any device or person able to observe the traffic, for example on shared Wi-Fi or through a compromised network device, can capture them without breaking any encryption. Because the flaw needs no privileges and no action from the user, it can be exploited silently, with the victim unaware that their credentials have been taken.

Until a fix is applied, the practical steps are to keep GV-Face traffic off networks where it can be intercepted, to treat any credentials that may have crossed an untrusted network as exposed and rotate them, and to apply GeoVision's advisory as soon as it is available for the installed version.