CVE-2026-22694mediumCWE-346

CVE-2026-22694: medium-severity vulnerability in aliasvault

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Published

Follow this CVE+ Monitor aliasvault

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.1%
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected products
aliasvault · aliasvault
Related CVEs — aliasvault

In the same product, most dangerous first.

CVE-2025-59344HIGHAliasVault Vulnerable to Server-Side Request Forgery via Favicon ExtractionEPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2026-94621MEDIUMAliasVault: Server-Side Request Forgery via DNS rebinding in Favicon ExtractionEPSS 0.2%CVE-2026-55587HIGHAliasVault: Browser extension WebAuthn bridge accepts forged origin/RP IDEPSS 0.1%