CVE-2026-22694mediumCWE-346

CVE-2026-22694: falha de média gravidade em aliasvault

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Publicada em

Seguir esta CVE+ Monitorar aliasvault

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.1%
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Produtos afetados
aliasvault · aliasvault
CVEs relacionadas — aliasvault

No mesmo produto, das mais perigosas para as menos.

CVE-2025-59344HIGHAliasVault Vulnerable to Server-Side Request Forgery via Favicon ExtractionEPSS 0.3%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.3%CVE-2026-94621MEDIUMAliasVault: Server-Side Request Forgery via DNS rebinding in Favicon ExtractionEPSS 0.2%CVE-2026-55587HIGHAliasVault: Browser extension WebAuthn bridge accepts forged origin/RP IDEPSS 0.1%