PT-2026-21499 · Unknown · Aliasvault Api

Nmaochea · Published 2026-02-23 · Updated 2026-03-12 · CVE-2026-2974

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AliasVault App versions through 0.25.3

Description A security issue exists in AliasVault App on Android/iOS. The issue is related to the Backup Handler component and affects the shared prefs/aliasvault.xml file. Manipulation of the accessToken, refreshToken, metadata, key derivation params, and auth methods arguments can lead to unauthorized exposure of backup files. The attack requires local access and is considered complex and difficult to exploit. The tokens stored in aliasvault.xml are API session tokens and do not, on their own, allow decryption of the vault; the master password is still required.

Recommendations Upgrade to version 0.26.0 to resolve the issue.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-530

Related Identifiers

CVE-2026-2974

Affected Products

Aliasvault Api

References · 14

• 🔥 https://github.com/aliasvault/aliasvault/issues/1497#issue-3855176470 · Exploit
• https://github.com/aliasvault/aliasvault/releases/tag/0.26.0 · Patch
• https://github.com/aliasvault/aliasvault/commit/873ecc03f92238e162f98a068ad56069a922b4f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-2974 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2974 · Vendor Advisory
• https://github.com/aliasvault/aliasvault/pull/1499 · Note
• https://github.com/aliasvault/aliasvault/issues/1497 · Note
• https://t.me/cveNotify/155309 · Telegram Post
• https://vuldb.com/?submit.756058 · Note
• https://vuldb.com/?id.347340 · Note
• https://vuldb.com/?submit.756059 · Note
• https://vuldb.com/?ctiid.347340 · Note
• https://t.me/CVEtracker/45477 · Telegram Post
• https://t.me/cveNotify/152814 · Telegram Post