CVE-2026-22694

MEDIUM EPSS 1.6%
Published Jan 14, 20265mo ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Jan 14, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.

CVSS Details

Base Score
6.1
Exploitability
1.8
Impact
4.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
1.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-346

Affected Products 1

VendorProductVersionRange
aliasvaultaliasvault*≥0.24.0  –  <0.25.3

References 5

  • github.com https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d
    Patch
  • github.com https://github.com/aliasvault/aliasvault/issues/1440
    Issue TrackingPatch
  • github.com https://github.com/aliasvault/aliasvault/pull/1441
    Issue TrackingPatch
  • github.com https://github.com/aliasvault/aliasvault/releases/tag/0.25.3
    ProductRelease Notes
  • github.com https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d
    Patch
  • github.com https://github.com/aliasvault/aliasvault/issues/1440
    Issue TrackingPatch
  • github.com https://github.com/aliasvault/aliasvault/pull/1441
    Issue TrackingPatch
  • github.com https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q
    MitigationPatchVendor Advisory