CVE-2026-107030 in YubiClip XOR fork
Summary
by MITRE • 10/29/2026
Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in CraftXBox's YubiClip XOR fork version 1.0.1 involves insecure file permissions that expose sensitive application data and functionality to unintended access vectors. This specific flaw allows unauthorized attackers, potentially including other applications installed on the same device or local users with limited privileges, to interact directly with the One-Time Password clipboard mechanism. The core technical issue stems from improper configuration of Android's permission model, where critical components are not sufficiently restricted by default settings such as android:exported=false or appropriate signature-level permissions. This misconfiguration creates a pathway for privilege escalation within the application sandbox, enabling external entities to invoke internal methods intended solely for authenticated user interactions.
From an operational perspective, this vulnerability leads directly to a desynchronization of the timing mechanism associated with OTP generation and retrieval. The YubiClip XOR fork relies on precise synchronization between the physical security key and the mobile device to ensure that time-based one-time passwords are generated correctly and displayed securely in the clipboard for immediate use by authentication services. When an unauthorized actor triggers this mechanism prematurely or repeatedly, it disrupts the internal state management of the OTP algorithm. This desynchronization can result in the generation of invalid codes, failure to display current valid tokens, or exposure of historical token data that may no longer be secure depending on the specific implementation details. Such disruption effectively denies legitimate users access to their authentication credentials while potentially exposing sensitive cryptographic material if the clipboard is not properly cleared after use.
This vulnerability aligns with CWE-732, which describes improper permission assignment for critical resources, and falls under the broader category of insecure default configurations often seen in mobile applications that fail to adhere to least privilege principles. In terms of offensive security frameworks like MITRE ATT&CK Mobile, this behavior is consistent with techniques involving component hijacking or unauthorized access to protected functions within an application's local environment. The ability to trigger clipboard mechanisms without authorization also touches upon CWE-209 regarding the exposure of sensitive information through error messages or unintended side effects, as the desynchronization may reveal timing patterns that could be exploited for further attacks against time-based authentication systems.
Mitigation strategies must focus on hardening the application's permission model and securing access to exported components. Developers should ensure that all activities, services, broadcast receivers, and content providers are explicitly set with android:exported=false unless there is a strict business requirement for external interaction, in which case signature or system-level permissions should be enforced rather than relying on default world-readable settings. Additionally, implementing robust input validation and state management checks before executing OTP-related functions can prevent unauthorized triggers from disrupting the timing synchronization logic. Regular security audits using static analysis tools configured to detect insecure permission configurations are recommended to identify similar flaws across the codebase. Users of this application should be advised to update to a patched version that addresses these permission restrictions, thereby restoring the integrity and reliability of the OTP authentication process while preventing unauthorized manipulation of clipboard contents.