Description
In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This allows unauthorized users to change PIN without knowing the original/current PIN.
References (4)
Core 4
Core References
Various Sources
http://payeer.com
Various Sources
https://payeer.com
Scores
CVSS v3
6.0
EPSS
0.0016
EPSS Percentile
5.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-284
Status
published
Published
Sep 29, 2025
Tracked Since
Feb 18, 2026