Description
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q
Issue Tracking x_refsource_misc
https://github.com/aliasvault/aliasvault/issues/1440
Issue Tracking x_refsource_misc
https://github.com/aliasvault/aliasvault/pull/1441
Patch x_refsource_misc
https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d
Release Notes x_refsource_misc
https://github.com/aliasvault/aliasvault/releases/tag/0.25.3
Scores
CVSS v3
6.1
EPSS
0.0011
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-346
Status
published
Products (1)
aliasvault/aliasvault
0.24.0 - 0.25.3
Published
Jan 14, 2026
Tracked Since
Feb 18, 2026