TI-2025-05154 CVE-2025-5715 · GHSA-2g9r-w7mh-f2h2
Signal App Biometric Authentication missing critical step in authentication
Priority MEDIUM 40
A vulnerability was found in Signal App 7.41.4 on Android.
Signal
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
Signal records in CISA KEVNo Signal vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Signal · all components
TI-2018-11532 CVE-2018-16132 · GHSA-qqwm-p976-w7mm
The image rendering component (createGenericPreview) of the Open Whisper Signal app…
Priority LOW 39
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images.
TI-2022-11105 CVE-2022-28345 · GHSA-9h9j-m9f5-4f79
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection.
Priority LOW 38
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection.
TI-2018-07005 CVE-2018-9840 · GHSA-9v25-mc3c-w5v3
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers…
Priority LOW 30
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app opening, clicking on cancel, and using t…
TI-2020-04681 CVE-2020-5753 · GHSA-cqgm-mqmr-px3p
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote…
Priority LOW 26
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answ…