CVE-2026-22694mediumCWE-346

CVE-2026-22694: fallo de gravedad media en aliasvault

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Publicada el

Seguir esta CVE+ Monitorear aliasvault

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.1%
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Productos afectados
aliasvault · aliasvault
CVEs relacionadas — aliasvault

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-59344HIGHAliasVault Vulnerable to Server-Side Request Forgery via Favicon ExtractionEPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2026-94621MEDIUMAliasVault: Server-Side Request Forgery via DNS rebinding in Favicon ExtractionEPSS 0.2%CVE-2026-55587HIGHAliasVault: Browser extension WebAuthn bridge accepts forged origin/RP IDEPSS 0.1%