The ministry app that lets drivers pull up their vehicle inspection certificate shipped with a flaw that exposed the credentials behind its own integration feature. Japan’s JVN advisory board flagged the issue on October 15, and it carries CVE-2026-75559.
What went wrong
The “Vehicle Inspection Certificate Viewer” app, published by the Ministry of Land, Infrastructure, Transport and Tourism, includes an API integration feature for operators who handle inspection certificates. That feature inserts sensitive data into outbound traffic, a weakness classified as CWE-201.
An access ID and access key tied to the API could leak as a result. JVN rated the issue 6.9 under CVSS 4.0 and 5.3 under CVSS 3.0.
Who is affected
Every build up to version 6.2.0 on both platforms carries the flaw, including iOS and Android versions 6.2.0 and earlier. The disclosure credits researcher Sho Ijiri, who reported the problem to Japan’s IPA.
The fix and why it closes the door
The ministry issued new access IDs and access keys to API users and revoked the ones that may have been exposed. That revocation matters as much as the patch. Even an attacker who captured the old credentials cannot use them now.
Users should still update to the latest release. Older installations keep the vulnerable code path on the device, and there is no reason to leave it there once a fixed build exists.
The bigger point
Inspection certificate tools sit at an awkward intersection. They handle vehicle records but lean on API keys never meant to travel inside an app’s network traffic. Inserting credentials into transmitted data turns a routine integration feature into a leak with a name and a number.
