Read the docs
TI-2021-07620 Aliases CVE-2021-25381GHSA-984v-wwcj-4259

Improper authorization in Samsung Account

Priority LOW 33CWE-285Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent.

Why it matters now

EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed Samsung Account (Samsung Mobile): 10.8.0.4, 12.1.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamsungSamsung AccountAndroid P(9.0) and below to before 10.8.0.4; Android Q(10.0) and above to before 12.1.1.310.8.0.4, 12.1.1.3Patch availableCNA
  • Samsung Account VendorSamsung Affected Android P(9.0) and below to before 10.8.0.4; Android Q(10.0) and above to before 12.1.1.3 Fixed in 10.8.0.4, 12.1.1.3 Patch available CNA

CPE configurations NVD · 65

CPEVersionsRoleVendor
cpe:2.3:a:samsung:account:10.8.0.4:*:*:*:*:*:*:*10.8.0.4VulnerableSamsung
cpe:2.3:o:google:android:1.0:*:*:*:*:*:*:*1.0Running onGoogle
cpe:2.3:o:google:android:1.1:*:*:*:*:*:*:*1.1Running onGoogle
cpe:2.3:o:google:android:1.5:*:*:*:*:*:*:*1.5Running onGoogle
cpe:2.3:o:google:android:1.6:*:*:*:*:*:*:*1.6Running onGoogle
cpe:2.3:o:google:android:2.0:*:*:*:*:*:*:*2.0Running onGoogle
cpe:2.3:o:google:android:2.0.1:*:*:*:*:*:*:*2.0.1Running onGoogle
cpe:2.3:o:google:android:2.1:*:*:*:*:*:*:*2.1Running onGoogle
cpe:2.3:o:google:android:2.2:*:*:*:*:*:*:*2.2Running onGoogle
cpe:2.3:o:google:android:2.2:rev1:*:*:*:*:*:*2.2 rev1Running onGoogle
  • cpe:2.3:a:samsung:account:10.8.0.4:*:*:*:*:*:*:* Versions 10.8.0.4 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·Google
  • cpe:2.3:o:google:android:1.1:*:*:*:*:*:*:* Versions 1.1 Running on ·Google
  • cpe:2.3:o:google:android:1.5:*:*:*:*:*:*:* Versions 1.5 Running on ·Google
  • cpe:2.3:o:google:android:1.6:*:*:*:*:*:*:* Versions 1.6 Running on ·Google
  • cpe:2.3:o:google:android:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·Google
  • cpe:2.3:o:google:android:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Running on ·Google
  • cpe:2.3:o:google:android:2.1:*:*:*:*:*:*:* Versions 2.1 Running on ·Google
  • cpe:2.3:o:google:android:2.2:*:*:*:*:*:*:* Versions 2.2 Running on ·Google
  • cpe:2.3:o:google:android:2.2:rev1:*:*:*:*:*:* Versions 2.2 rev1 Running on ·Google
Show 55 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:google:android:2.2.1:*:*:*:*:*:*:*2.2.1Running onGoogle
cpe:2.3:o:google:android:2.2.2:*:*:*:*:*:*:*2.2.2Running onGoogle
cpe:2.3:o:google:android:2.2.3:*:*:*:*:*:*:*2.2.3Running onGoogle
cpe:2.3:o:google:android:2.3:*:*:*:*:*:*:*2.3Running onGoogle
cpe:2.3:o:google:android:2.3:rev1:*:*:*:*:*:*2.3 rev1Running onGoogle
cpe:2.3:o:google:android:2.3.1:*:*:*:*:*:*:*2.3.1Running onGoogle
cpe:2.3:o:google:android:2.3.2:*:*:*:*:*:*:*2.3.2Running onGoogle
cpe:2.3:o:google:android:2.3.3:*:*:*:*:*:*:*2.3.3Running onGoogle
cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:*2.3.4Running onGoogle
cpe:2.3:o:google:android:2.3.5:*:*:*:*:*:*:*2.3.5Running onGoogle
cpe:2.3:o:google:android:2.3.6:*:*:*:*:*:*:*2.3.6Running onGoogle
cpe:2.3:o:google:android:2.3.7:*:*:*:*:*:*:*2.3.7Running onGoogle
cpe:2.3:o:google:android:3.0:*:*:*:*:*:*:*3.0Running onGoogle
cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:*3.1Running onGoogle
cpe:2.3:o:google:android:3.2:*:*:*:*:*:*:*3.2Running onGoogle
cpe:2.3:o:google:android:3.2.1:*:*:*:*:*:*:*3.2.1Running onGoogle
cpe:2.3:o:google:android:3.2.2:*:*:*:*:*:*:*3.2.2Running onGoogle
cpe:2.3:o:google:android:3.2.4:*:*:*:*:*:*:*3.2.4Running onGoogle
cpe:2.3:o:google:android:3.2.6:*:*:*:*:*:*:*3.2.6Running onGoogle
cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*4.0Running onGoogle
cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*4.0.1Running onGoogle
cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*4.0.2Running onGoogle
cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*4.0.3Running onGoogle
cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*4.0.4Running onGoogle
cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*4.1Running onGoogle
cpe:2.3:o:google:android:4.1.1:*:*:*:*:*:*:*4.1.1Running onGoogle
cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*4.1.2Running onGoogle
cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*4.2Running onGoogle
cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*4.2.1Running onGoogle
cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*4.2.2Running onGoogle
cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*4.3Running onGoogle
cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*4.3.1Running onGoogle
cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*4.4Running onGoogle
cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*4.4.1Running onGoogle
cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*4.4.2Running onGoogle
cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*4.4.3Running onGoogle
cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*4.4.4Running onGoogle
cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*5.0Running onGoogle
cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*5.0.1Running onGoogle
cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*5.0.2Running onGoogle
cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*5.1Running onGoogle
cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*5.1.0Running onGoogle
cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*5.1.1Running onGoogle
cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*6.0Running onGoogle
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*6.0.1Running onGoogle
cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*7.0Running onGoogle
cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*7.1.0Running onGoogle
cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*7.1.1Running onGoogle
cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*7.1.2Running onGoogle
cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*8.0Running onGoogle
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*8.1Running onGoogle
cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*9.0Running onGoogle
cpe:2.3:a:samsung:account:12.1.1.3:*:*:*:*:*:*:*12.1.1.3VulnerableSamsung
cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*10.0Running onGoogle
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*11.0Running onGoogle
  • cpe:2.3:o:google:android:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Running on ·Google
  • cpe:2.3:o:google:android:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Running on ·Google
  • cpe:2.3:o:google:android:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Running on ·Google
  • cpe:2.3:o:google:android:2.3:*:*:*:*:*:*:* Versions 2.3 Running on ·Google
  • cpe:2.3:o:google:android:2.3:rev1:*:*:*:*:*:* Versions 2.3 rev1 Running on ·Google
  • cpe:2.3:o:google:android:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Running on ·Google
  • cpe:2.3:o:google:android:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Running on ·Google
  • cpe:2.3:o:google:android:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Running on ·Google
  • cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Running on ·Google
  • cpe:2.3:o:google:android:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Running on ·Google
  • cpe:2.3:o:google:android:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Running on ·Google
  • cpe:2.3:o:google:android:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Running on ·Google
  • cpe:2.3:o:google:android:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·Google
  • cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:* Versions 3.1 Running on ·Google
  • cpe:2.3:o:google:android:3.2:*:*:*:*:*:*:* Versions 3.2 Running on ·Google
  • cpe:2.3:o:google:android:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Running on ·Google
  • cpe:2.3:o:google:android:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Running on ·Google
  • cpe:2.3:o:google:android:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Running on ·Google
  • cpe:2.3:o:google:android:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Running on ·Google
  • cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Google
  • cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Running on ·Google
  • cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Running on ·Google
  • cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Running on ·Google
  • cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Running on ·Google
  • cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:* Versions 4.1 Running on ·Google
  • cpe:2.3:o:google:android:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Running on ·Google
  • cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Running on ·Google
  • cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:* Versions 4.2 Running on ·Google
  • cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Running on ·Google
  • cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Running on ·Google
  • cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:* Versions 4.3 Running on ·Google
  • cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Running on ·Google
  • cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:* Versions 4.4 Running on ·Google
  • cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:* Versions 4.4.1 Running on ·Google
  • cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:* Versions 4.4.2 Running on ·Google
  • cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:* Versions 4.4.3 Running on ·Google
  • cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:* Versions 4.4.4 Running on ·Google
  • cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Google
  • cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Running on ·Google
  • cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Running on ·Google
  • cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:* Versions 5.1 Running on ·Google
  • cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Running on ·Google
  • cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Running on ·Google
  • cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Google
  • cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Running on ·Google
  • cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Google
  • cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Running on ·Google
  • cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:* Versions 7.1.1 Running on ·Google
  • cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:* Versions 7.1.2 Running on ·Google
  • cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Google
  • cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* Versions 8.1 Running on ·Google
  • cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Google
  • cpe:2.3:a:samsung:account:12.1.1.3:*:*:*:*:*:*:* Versions 12.1.1.3 Vulnerable ·Samsung
  • cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:* Versions 10.0 Running on ·Google
  • cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Running on ·Google

Remediation

  • Fix · CNA Samsung Account (Samsung Mobile) Fixed in 10.8.0.4, 12.1.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25381
  2. 2026-10-03 Alias added: GHSA-984v-wwcj-4259

References

Advisory 2

  • TI-2022-12867 Information disclosure in Samsung Account CVSS 3.1HIGH 7.5
  • TI-2023-07882 Improper URL input validation vulnerability in Samsung Account application prior to… CVSS 3.1HIGH 7.5
  • TI-2022-12870 Information disclosure in Samsung Account CVSS 3.1HIGH 7.5
  • TI-2026-17011 URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token. CVSS 4.0MEDIUM 6.9
  • TI-2023-22701 Exposure of resource to wrong sphere in Samsung Account CVSS 3.1MEDIUM 6.5
  • TI-2023-22700 Use of implicit intent for sensitive communication vulnerability in startSignIn in… CVSS 3.1MEDIUM 6.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences