The EquityPandit application contains an insecure logging vulnerability that exposes plaintext user credentials to local attackers, creating a significant risk of unauthorized account access.

The application utilizes improper logging practices by writing sensitive user credentials to the developer console during the forgot password process. This vulnerability is accessible to any user or process with access to the Android Debug Bridge (ADB) logcat output, requiring no authentication to the application itself to intercept the data.

The exposure of plaintext passwords directly facilitates account takeover attacks, which can lead to unauthorized access to sensitive financial or personal information stored within the user account. Given the CVSS score of 7.5, this high-severity vulnerability poses a substantial risk of data compromise and potential reputational damage to the service provider.

Immediate Action: Users of the EquityPandit application should ensure they are running the latest available version of the software provided by the vendor. If an update is not available, administrators should restrict physical and logical access to devices running the application to prevent unauthorized ADB connections.

Proactive Monitoring: Security teams should review mobile application logs for evidence of debug-mode activity or anomalous access to device-level debugging interfaces.

Compensating Controls: Implement mobile device management (MDM) policies to disable USB debugging on managed devices to prevent unauthorized access via the Android Debug Bridge.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit-DB entry (EDB-ID: 46933).

This vulnerability represents a critical failure in secure development practices regarding sensitive information handling. Organizations should prioritize updating the application to a patched version that removes sensitive data from application logs and strictly enforce policies that prohibit the use of debugging interfaces on production-deployed mobile hardware.