Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-94621 (GCVE-0-2026-94621)

Vulnerability from nvd – Published: 2026-10-15 18:23 – Updated: 2026-10-16 17:11

Title

AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 20:24 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/pull/2311	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/7…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/9…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

4 products

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.30.3
aliasvault	ghcr.io/aliasvault/aliasvault	Affected: < 0.30.3
aliasvault	ghcr.io/aliasvault/api	Affected: < 0.30.3
aliasvault	ghcr.io/lanedirt/aliasvault-api	Affected: < 0.30.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:24:54.558375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:11:53.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/aliasvault/aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/aliasvault/api",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/lanedirt/aliasvault-api",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:23:33.174Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/2311",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/2311"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3"
        }
      ],
      "source": {
        "advisory": "GHSA-7hm6-fj4m-pf6f",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-94621",
    "datePublished": "2026-10-15T18:23:33.174Z",
    "dateReserved": "2026-09-21T21:32:23.742Z",
    "dateUpdated": "2026-10-16T17:11:53.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55587 (GCVE-0-2026-55587)

Vulnerability from nvd – Published: 2026-10-15 18:21 – Updated: 2026-10-15 18:21

Title

AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/commit/a…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.29.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.29.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:21:53.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4"
        }
      ],
      "source": {
        "advisory": "GHSA-f99p-jfhr-6ffc",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55587",
    "datePublished": "2026-10-15T18:21:53.069Z",
    "dateReserved": "2026-06-16T23:18:03.169Z",
    "dateUpdated": "2026-10-15T18:21:53.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26266 (GCVE-0-2026-26266)

Vulnerability from nvd – Published: 2026-03-03 22:16 – Updated: 2026-03-04 16:52

Title

AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 16:49 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/commit/3…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26266",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T16:49:44.458482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T16:52:03.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.["
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T22:16:15.387Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f65p-p65r-g53q",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26266",
    "datePublished": "2026-03-03T22:16:15.387Z",
    "dateReserved": "2026-02-12T17:10:53.412Z",
    "dateUpdated": "2026-03-04T16:52:03.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2974 (GCVE-0-2026-2974)

Vulnerability from nvd – Published: 2026-02-23 05:32 – Updated: 2026-02-23 13:23 X_Open Source

Title

AliasVault App Backup aliasvault.xml backup

Summary

A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/auth_methods leads to exposure of backup file to an unauthorized control sphere. An attack has to be approached locally. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 0.26.0 is able to resolve this issue. The identifier of the patch is 873ecc03f92238e162f98a068ad56069a922b4f6/0bd662320174d8265dfe3b05a04bc13efc960532. It is recommended to upgrade the affected component. The creator of the software explains: "Because of AliasVault's zero-knowledge encryption design, the tokens stored in aliasvault.xml are API session tokens that cannot decrypt the vault on their own: the master password is required for that. So while this isn't a direct vault compromise risk, there's no reason to include them in backups either."

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

2.5 (Low)


                        
                          CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-23 13:23 UTC

CWE

CWE-530 - Exposure of Backup File to an Unauthorized Control Sphere
CWE-285 - Improper Authorization

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3902 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/?id.347340	vdb-entrytechnical-description
https://vuldb.com/?ctiid.347340	signaturepermissions-required
https://vuldb.com/?submit.756058	third-party-advisory
https://vuldb.com/?submit.756059	third-party-advisory
https://github.com/aliasvault/aliasvault/issues/1497	issue-tracking
https://github.com/aliasvault/aliasvault/pull/1499	issue-tracking
https://github.com/aliasvault/aliasvault/issues/1…	exploitissue-tracking
https://github.com/aliasvault/aliasvault/commit/8…	patch
https://github.com/aliasvault/aliasvault/releases…	patch

Impacted products

1 product

Vendor	Product	Version
n/a	AliasVault App	Affected: 0.25.0 Affected: 0.25.1 Affected: 0.25.2 Affected: 0.25.3 Unaffected: 0.26.0

Credits

nmaochea (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2974",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-23T13:23:46.315906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-23T13:23:56.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Backup Handler"
          ],
          "product": "AliasVault App",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.25.0"
            },
            {
              "status": "affected",
              "version": "0.25.1"
            },
            {
              "status": "affected",
              "version": "0.25.2"
            },
            {
              "status": "affected",
              "version": "0.25.3"
            },
            {
              "status": "unaffected",
              "version": "0.26.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "nmaochea (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/auth_methods leads to exposure of backup file to an unauthorized control sphere. An attack has to be approached locally. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 0.26.0 is able to resolve this issue. The identifier of the patch is 873ecc03f92238e162f98a068ad56069a922b4f6/0bd662320174d8265dfe3b05a04bc13efc960532. It is recommended to upgrade the affected component. The creator of the software explains: \"Because of AliasVault\u0027s zero-knowledge encryption design, the tokens stored in aliasvault.xml are API session tokens that cannot decrypt the vault on their own: the master password is required for that. So while this isn\u0027t a direct vault compromise risk, there\u0027s no reason to include them in backups either.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1,
            "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-530",
              "description": "Exposure of Backup File to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-23T05:32:10.154Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-347340 | AliasVault App Backup aliasvault.xml backup",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.347340"
        },
        {
          "name": "VDB-347340 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.347340"
        },
        {
          "name": "Submit #756058 | AliasVault v0.25.3 Insecure Storage of Sensitive Information",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.756058"
        },
        {
          "name": "Submit #756059 | AliasVault v0.25.3 Insecure Storage of Sensitive Information (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.756059"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1497"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1499"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1497#issue-3855176470"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/873ecc03f92238e162f98a068ad56069a922b4f6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-22T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-02-22T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-02-22T15:52:42.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "AliasVault App Backup aliasvault.xml backup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-2974",
    "datePublished": "2026-02-23T05:32:10.154Z",
    "dateReserved": "2026-02-22T14:47:26.948Z",
    "dateUpdated": "2026-02-23T13:23:56.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22694 (GCVE-0-2026-22694)

Vulnerability from nvd – Published: 2026-01-14 16:32 – Updated: 2026-01-14 16:59

Title

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 16:59 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/issues/1440	x_refsource_MISC
https://github.com/aliasvault/aliasvault/pull/1441	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/b…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: >= 0.24.0, < 0.25.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T16:59:17.521627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T16:59:24.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.24.0, \u003c 0.25.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-14T16:32:36.007Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/issues/1440",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1440"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/1441",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1441"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3"
        }
      ],
      "source": {
        "advisory": "GHSA-mvg4-wvjv-332q",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault is Missing Origin Validation in Android Passkey Credential Provider"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22694",
    "datePublished": "2026-01-14T16:32:36.007Z",
    "dateReserved": "2026-01-08T19:23:09.855Z",
    "dateUpdated": "2026-01-14T16:59:24.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59344 (GCVE-0-2025-59344)

Vulnerability from nvd – Published: 2025-09-19 15:21 – Updated: 2025-09-19 16:08

Title

AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-19 16:08 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/pull/1226	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/5…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.23.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59344",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T16:08:22.765918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T16:08:33.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows \u003clink rel=\"icon\" href=\"\u2026\"\u003e. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T15:21:19.533Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/1226",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1226"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-f253-f7xc-w7pj",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59344",
    "datePublished": "2025-09-19T15:21:19.533Z",
    "dateReserved": "2025-09-12T12:36:24.636Z",
    "dateUpdated": "2025-09-19T16:08:33.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-94621 (GCVE-0-2026-94621)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:23 – Updated: 2026-10-16 17:11

Title

AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 20:24 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/pull/2311	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/7…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/9…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

4 products

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.30.3
aliasvault	ghcr.io/aliasvault/aliasvault	Affected: < 0.30.3
aliasvault	ghcr.io/aliasvault/api	Affected: < 0.30.3
aliasvault	ghcr.io/lanedirt/aliasvault-api	Affected: < 0.30.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:24:54.558375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:11:53.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/aliasvault/aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/aliasvault/api",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        },
        {
          "product": "ghcr.io/lanedirt/aliasvault-api",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.30.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:23:33.174Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/2311",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/2311"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3"
        }
      ],
      "source": {
        "advisory": "GHSA-7hm6-fj4m-pf6f",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-94621",
    "datePublished": "2026-10-15T18:23:33.174Z",
    "dateReserved": "2026-09-21T21:32:23.742Z",
    "dateUpdated": "2026-10-16T17:11:53.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55587 (GCVE-0-2026-55587)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:21 – Updated: 2026-10-15 18:21

Title

AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/commit/a…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.29.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.29.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:21:53.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4"
        }
      ],
      "source": {
        "advisory": "GHSA-f99p-jfhr-6ffc",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55587",
    "datePublished": "2026-10-15T18:21:53.069Z",
    "dateReserved": "2026-06-16T23:18:03.169Z",
    "dateUpdated": "2026-10-15T18:21:53.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26266 (GCVE-0-2026-26266)

Vulnerability from cvelistv5 – Published: 2026-03-03 22:16 – Updated: 2026-03-04 16:52

Title

AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-04 16:49 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/commit/3…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26266",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-04T16:49:44.458482Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-04T16:52:03.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.["
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-03T22:16:15.387Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f65p-p65r-g53q",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26266",
    "datePublished": "2026-03-03T22:16:15.387Z",
    "dateReserved": "2026-02-12T17:10:53.412Z",
    "dateUpdated": "2026-03-04T16:52:03.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2974 (GCVE-0-2026-2974)

Vulnerability from cvelistv5 – Published: 2026-02-23 05:32 – Updated: 2026-02-23 13:23 X_Open Source

Title

AliasVault App Backup aliasvault.xml backup

Summary

A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/auth_methods leads to exposure of backup file to an unauthorized control sphere. An attack has to be approached locally. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 0.26.0 is able to resolve this issue. The identifier of the patch is 873ecc03f92238e162f98a068ad56069a922b4f6/0bd662320174d8265dfe3b05a04bc13efc960532. It is recommended to upgrade the affected component. The creator of the software explains: "Because of AliasVault's zero-knowledge encryption design, the tokens stored in aliasvault.xml are API session tokens that cannot decrypt the vault on their own: the master password is required for that. So while this isn't a direct vault compromise risk, there's no reason to include them in backups either."

Severity

2 (Low)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

2.5 (Low)


                        
                          CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-23 13:23 UTC

CWE

CWE-530 - Exposure of Backup File to an Unauthorized Control Sphere
CWE-285 - Improper Authorization

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3902 records in the last 180 days details

References

9 references

URL	Tags
https://vuldb.com/?id.347340	vdb-entrytechnical-description
https://vuldb.com/?ctiid.347340	signaturepermissions-required
https://vuldb.com/?submit.756058	third-party-advisory
https://vuldb.com/?submit.756059	third-party-advisory
https://github.com/aliasvault/aliasvault/issues/1497	issue-tracking
https://github.com/aliasvault/aliasvault/pull/1499	issue-tracking
https://github.com/aliasvault/aliasvault/issues/1…	exploitissue-tracking
https://github.com/aliasvault/aliasvault/commit/8…	patch
https://github.com/aliasvault/aliasvault/releases…	patch

Impacted products

1 product

Vendor	Product	Version
n/a	AliasVault App	Affected: 0.25.0 Affected: 0.25.1 Affected: 0.25.2 Affected: 0.25.3 Unaffected: 0.26.0

Credits

nmaochea (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2974",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-23T13:23:46.315906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-23T13:23:56.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Backup Handler"
          ],
          "product": "AliasVault App",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.25.0"
            },
            {
              "status": "affected",
              "version": "0.25.1"
            },
            {
              "status": "affected",
              "version": "0.25.2"
            },
            {
              "status": "affected",
              "version": "0.25.3"
            },
            {
              "status": "unaffected",
              "version": "0.26.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "nmaochea (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/auth_methods leads to exposure of backup file to an unauthorized control sphere. An attack has to be approached locally. The attack is considered to have high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 0.26.0 is able to resolve this issue. The identifier of the patch is 873ecc03f92238e162f98a068ad56069a922b4f6/0bd662320174d8265dfe3b05a04bc13efc960532. It is recommended to upgrade the affected component. The creator of the software explains: \"Because of AliasVault\u0027s zero-knowledge encryption design, the tokens stored in aliasvault.xml are API session tokens that cannot decrypt the vault on their own: the master password is required for that. So while this isn\u0027t a direct vault compromise risk, there\u0027s no reason to include them in backups either.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1,
            "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-530",
              "description": "Exposure of Backup File to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-23T05:32:10.154Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-347340 | AliasVault App Backup aliasvault.xml backup",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.347340"
        },
        {
          "name": "VDB-347340 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.347340"
        },
        {
          "name": "Submit #756058 | AliasVault v0.25.3 Insecure Storage of Sensitive Information",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.756058"
        },
        {
          "name": "Submit #756059 | AliasVault v0.25.3 Insecure Storage of Sensitive Information (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.756059"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1497"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1499"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1497#issue-3855176470"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/873ecc03f92238e162f98a068ad56069a922b4f6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-22T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-02-22T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-02-22T15:52:42.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "AliasVault App Backup aliasvault.xml backup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-2974",
    "datePublished": "2026-02-23T05:32:10.154Z",
    "dateReserved": "2026-02-22T14:47:26.948Z",
    "dateUpdated": "2026-02-23T13:23:56.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22694 (GCVE-0-2026-22694)

Vulnerability from cvelistv5 – Published: 2026-01-14 16:32 – Updated: 2026-01-14 16:59

Title

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-14 16:59 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/issues/1440	x_refsource_MISC
https://github.com/aliasvault/aliasvault/pull/1441	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/b…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: >= 0.24.0, < 0.25.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T16:59:17.521627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T16:59:24.012Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.24.0, \u003c 0.25.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-14T16:32:36.007Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/issues/1440",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/issues/1440"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/1441",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1441"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3"
        }
      ],
      "source": {
        "advisory": "GHSA-mvg4-wvjv-332q",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault is Missing Origin Validation in Android Passkey Credential Provider"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-22694",
    "datePublished": "2026-01-14T16:32:36.007Z",
    "dateReserved": "2026-01-08T19:23:09.855Z",
    "dateUpdated": "2026-01-14T16:59:24.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59344 (GCVE-0-2025-59344)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:21 – Updated: 2025-09-19 16:08

Title

AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-19 16:08 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7627 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/aliasvault/aliasvault/security…	x_refsource_CONFIRM
https://github.com/aliasvault/aliasvault/pull/1226	x_refsource_MISC
https://github.com/aliasvault/aliasvault/commit/5…	x_refsource_MISC
https://github.com/aliasvault/aliasvault/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
aliasvault	aliasvault	Affected: < 0.23.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59344",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-19T16:08:22.765918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-19T16:08:33.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aliasvault",
          "vendor": "aliasvault",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows \u003clink rel=\"icon\" href=\"\u2026\"\u003e. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-19T15:21:19.533Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/pull/1226",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/pull/1226"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968"
        },
        {
          "name": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-f253-f7xc-w7pj",
        "discovery": "UNKNOWN"
      },
      "title": "AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59344",
    "datePublished": "2025-09-19T15:21:19.533Z",
    "dateReserved": "2025-09-12T12:36:24.636Z",
    "dateUpdated": "2025-09-19T16:08:33.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities by aliasvault

CVE-2026-94621 (GCVE-0-2026-94621)

CVE-2026-55587 (GCVE-0-2026-55587)

CVE-2026-26266 (GCVE-0-2026-26266)

CVE-2026-2974 (GCVE-0-2026-2974)

CVE-2026-22694 (GCVE-0-2026-22694)

CVE-2025-59344 (GCVE-0-2025-59344)

CVE-2026-94621 (GCVE-0-2026-94621)

CVE-2026-55587 (GCVE-0-2026-55587)

CVE-2026-26266 (GCVE-0-2026-26266)

CVE-2026-2974 (GCVE-0-2026-2974)

CVE-2026-22694 (GCVE-0-2026-22694)

CVE-2025-59344 (GCVE-0-2025-59344)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities by aliasvault

CVE-2026-94621 (GCVE-0-2026-94621)

CVE-2026-55587 (GCVE-0-2026-55587)

CVE-2026-26266 (GCVE-0-2026-26266)

CVE-2026-2974 (GCVE-0-2026-2974)

CVE-2026-22694 (GCVE-0-2026-22694)

CVE-2025-59344 (GCVE-0-2025-59344)

CVE-2026-94621 (GCVE-0-2026-94621)

CVE-2026-55587 (GCVE-0-2026-55587)

CVE-2026-26266 (GCVE-0-2026-26266)

CVE-2026-2974 (GCVE-0-2026-2974)

CVE-2026-22694 (GCVE-0-2026-22694)

CVE-2025-59344 (GCVE-0-2025-59344)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.