Read the docs
TI-2026-18221 Aliases CVE-2026-22694

AliasVault is Missing Origin Validation in Android Passkey Credential Provider

Priority LOW 26CWE-346Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00135 2nd percentileScored 2026-11-07
Fix Fixed aliasvault (aliasvault): 0.25.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aliasvaultaliasvault0.24.0 to before 0.25.30.25.3Patch availableCNA
  • aliasvault Vendoraliasvault Affected 0.24.0 to before 0.25.3 Fixed in 0.25.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aliasvault:aliasvault:*:*:*:*:*:*:*:*0.24.0 to before 0.25.3Vulnerablealiasvault
  • cpe:2.3:a:aliasvault:aliasvault:*:*:*:*:*:*:*:* Versions 0.24.0 to before 0.25.3 Vulnerable ·aliasvault

Remediation

  • Fix · CNA aliasvault (aliasvault) Fixed in 0.25.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22694

References

Patch 4

Other 1

  • TI-2026-02566 AliasVault App Backup aliasvault.xml backup CVSS 4.0LOW 2.0
  • TI-2026-21236 AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences