Resamania Virtuagym is vulnerable to unauthorized physical access QR code generation due to the use of hard-coded credentials, posing a significant risk to facility security.

This vulnerability involves the use of hard-coded credentials (CWE-798) where the badge_number parameter serves as a static HMAC private key. An authenticated user can exploit this via the /club/id_club/member/id_member/resamania_qr_info API endpoint to generate persistent access codes.

The exploitation of this flaw allows attackers to bypass physical security controls by generating valid access credentials for any facility member. Given the CVSS score of 8.6, this represents a high-severity risk that could lead to unauthorized physical facility entry, potential theft, and severe reputational damage.

Immediate Action: Contact the vendor immediately to obtain the necessary security update or configuration change to rotate the hard-coded cryptographic keys.

Proactive Monitoring: Review API access logs for unusual patterns or high volumes of requests directed at the resamania_qr_info endpoint.

Compensating Controls: Implement strict API rate limiting and monitor for unauthorized access attempts from suspicious service accounts or user sessions.

Public Exploit Available: Unknown

This vulnerability presents a clear and present danger to physical infrastructure security. Administrators must treat this as a high-priority issue and coordinate with Resamania support to verify if a patch is available or if manual key rotation is required to invalidate existing QR code generation logic.