Alta Video -1927: Android app receives push notifications even after logging out

Release Date

4th of February 2026.

Overview

A vulnerability was discovered in the Alta Video Android application where the application continued to receive notifications after a user initiated a logout.

Affected Products

• Alta Video:
  • All Android app Stable upgrade channel versions before 3.11.
  • All Android app Beta upgrade channel versions before 3.11.

Unaffected Products

• Alta Video:

  • All Android app Stable upgrade channel versions after and including 3.11.
  • All Android app Beta upgrade channel versions after and including 3.11.

• Avigilon Cloud-Native Cameras: all versions.

• Alta Video Cloud: all versions.

Resolution

This issue has been fixed in Alta Video Android app Beta upgrade channel version 3.11 and Stable upgrade channel version 3.11.

Vulnerability Information

• CVSS score: 5.3 (Medium)
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Mitigations

There are no known mitigations for this issue.

Work arounds

There are no known work arounds for this issue.

Acknowledgements

Issue discovered and reported internally.

Disclosure Timeline

• 28/05/2025 Issue found
• 28/05/2025 Root cause established
• 28/05/2025 Fix identified
• 03/07/2025 Patched Alta Video (Beta upgrade channel) released
• 10/07/2025 Patched Alta Video (Stable upgrade channel) released
• 04/02/2026 Vulnerability publicly disclosed