jvndb - jvndb-2025-001605

JVNDB-2025-001605

Vulnerability from jvndb - Published: 2025-02-20 20:15 - Updated:2025-02-20 20:15

Severity ?

5.2 (Medium) - cvssV3_0 - CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

"RoboForm Password Manager" App for Android vulnerable to authentication bypass using an alternate path or channel

Details

"RoboForm Password Manager" App for Android provided by Siber Systems, Inc. is vulnerable to authentication bypass using an alternate path or channel (CWE-288). Johan Francsics reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU92071645/
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-26700
	Authentication Bypass Using an Alternate Path or Channel(CWE-288)	https://cwe.mitre.org/data/definitions/288.html

Impacted products

Vendor

Product

Siber Systems Inc.

RoboForm Password Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-001605.html",
  "dc:date": "2025-02-20T20:15+09:00",
  "dcterms:issued": "2025-02-20T20:15+09:00",
  "dcterms:modified": "2025-02-20T20:15+09:00",
  "description": "\"RoboForm Password Manager\" App for Android provided by Siber Systems, Inc. is vulnerable to authentication bypass using an alternate path or channel (CWE-288).\r\n\r\nJohan Francsics reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-001605.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:siber_systems_roboform_password",
    "@product": "RoboForm Password Manager",
    "@vendor": "Siber Systems Inc.",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "5.2",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-001605",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92071645/",
      "@id": "JVNVU#92071645",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-26700",
      "@id": "CVE-2025-26700",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/288.html",
      "@id": "CWE-288",
      "@title": "Authentication Bypass Using an Alternate Path or Channel(CWE-288)"
    }
  ],
  "title": "\"RoboForm Password Manager\" App for Android vulnerable to authentication bypass using an alternate path or channel"
}

CVE-2025-26700 (GCVE-0-2025-26700)

Vulnerability from cvelistv5 – Published: 2025-02-17 02:59 – Updated: 2025-02-18 15:56

Summary

Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4, which may allow an attacker with access to a device where the application is installed to bypass the lock screen and obtain sensitive information.

Severity ?

5.2 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

jpcert

References

URL

Tags

	https://www.roboform.com/news-android
	https://jvn.jp/en/vu/JVNVU92071645/

Impacted products

	Vendor	Product	Version
	Siber Systems, Inc.	RoboForm Password Manager	Affected: prior to 9.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T15:56:00.718171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T15:56:18.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RoboForm Password Manager",
          "vendor": "Siber Systems, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 9.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication bypass using an alternate path or channel issue exists in \u201dRoboForm Password Manager\" App for Android versions prior to 9.7.4, which may allow an attacker with access to a device where the application is installed to bypass the lock screen and obtain sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-17T02:59:57.779Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.roboform.com/news-android"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU92071645/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-26700",
    "datePublished": "2025-02-17T02:59:57.779Z",
    "dateReserved": "2025-02-14T05:05:05.660Z",
    "dateUpdated": "2025-02-18T15:56:18.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2025-001605

CVE-2025-26700 (GCVE-0-2025-26700)

Tags

Sightings

Nomenclature