PT-2026-21499 · Unknown · Aliasvault Api

Nmaochea · Publicado 2026-02-23 · Atualizado 2026-03-12 · CVE-2026-2974

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AliasVault App versions through 0.25.3

Description A security issue exists in AliasVault App on Android/iOS. The issue is related to the Backup Handler component and affects the shared prefs/aliasvault.xml file. Manipulation of the accessToken, refreshToken, metadata, key derivation params, and auth methods arguments can lead to unauthorized exposure of backup files. The attack requires local access and is considered complex and difficult to exploit. The tokens stored in aliasvault.xml are API session tokens and do not, on their own, allow decryption of the vault; the master password is still required.

Recommendations Upgrade to version 0.26.0 to resolve the issue.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

CWE-530

Identificadores relacionados

CVE-2026-2974

Produtos afetados

Aliasvault Api

Referências · 14

• 🔥 https://github.com/aliasvault/aliasvault/issues/1497#issue-3855176470 · Exploit
• https://github.com/aliasvault/aliasvault/releases/tag/0.26.0 · Correção
• https://github.com/aliasvault/aliasvault/pull/1499 · Nota
• https://github.com/aliasvault/aliasvault/issues/1497 · Nota
• https://github.com/aliasvault/aliasvault/commit/873ecc03f92238e162f98a068ad56069a922b4f6 · Correção
• https://t.me/cveNotify/155309 · Publicação no Telegram
• https://vuldb.com/?submit.756058 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2974 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-2974 · Aviso do Fabricante
• https://vuldb.com/?id.347340 · Nota
• https://vuldb.com/?submit.756059 · Nota
• https://vuldb.com/?ctiid.347340 · Nota
• https://t.me/CVEtracker/45477 · Publicação no Telegram
• https://t.me/cveNotify/152814 · Publicação no Telegram