CVE-2026-55889 in xdg-desktop-portal
Summary
by MITRE • 10/23/2026
XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The XDG Desktop Portal serves as a critical interface for sandboxed applications to interact with desktop services such as file access, screen sharing, and input handling. A significant security flaw was identified in versions prior to 1.22.1 regarding the implementation of random number generation used for session tokens. These tokens are essential for authorizing resource access during operations like drag-and-drop or copy-paste events between applications. The vulnerability stems from the use of GLib's GRand, which is based on the Mersenne Twister pseudo-random number generator algorithm. Unlike cryptographically secure pseudorandom number generators that utilize entropy sources to ensure unpredictability, the Mersenne Twister produces a deterministic sequence of numbers if its internal state is known or can be inferred from output data.
The core technical flaw lies in the predictability of these session tokens. When an application requests access to resources via methods such as FileTransfer.RetrieveFiles, the portal generates a token intended to prove authorization for that specific action. The design assumes that sharing this token out-of-band is secure because it should be impossible to guess or reproduce without direct interaction with the system's entropy sources. However, because GRand relies on Mersenne Twister, an attacker can observe enough generated tokens to reverse-engineer the internal state of the random number generator. Once the state is recovered, the attacker gains the ability to predict all future tokens that will be issued by the portal for subsequent operations. This effectively breaks the assumption of token unpredictability and allows malicious sandboxed applications to forge valid authorization credentials without legitimate user interaction or system permission grants.
The operational impact of this vulnerability is severe in terms of privilege escalation within the context of desktop isolation models. A malicious application operating under strict sandboxing constraints can exploit this flaw to redirect drag-and-drop data, copy-paste content, and file access requests intended for other applications back to itself. By predicting valid tokens, the attacker can impersonate legitimate user actions or trick target applications into accepting unauthorized transfers. This undermines the fundamental security boundaries established by desktop environments like GNOME or KDE, allowing sandboxed apps to exfiltrate sensitive data from protected areas of the system or manipulate file operations in ways that bypass standard permission checks. The ability to predict tokens means that even if a token is transmitted over an insecure channel or intercepted during normal operation, it can be reused or forged by an adversary who has observed previous interactions.
This vulnerability aligns with CWE-330, which describes the use of insufficiently random values for security-critical purposes. It also relates to CWE-284, indicating improper access control where authentication mechanisms are bypassed due to weak implementation details. From a tactical perspective, this flaw facilitates lateral movement and data exfiltration within a compromised desktop environment, mapping closely to ATT&CK techniques involving credential dumping or abuse of trusted processes for unauthorized resource access. The issue highlights the danger of using general-purpose pseudorandom generators in security-sensitive contexts where unpredictability is paramount.
To mitigate this risk, users must upgrade XDG Desktop Portal to version 1.22.1 or later, where the underlying random number generation has been corrected to use cryptographically secure alternatives that do not suffer from state predictability issues. System administrators should ensure that desktop environments are kept up-to-date with security patches addressing PRNG weaknesses in authentication and session management components. Additionally, developers integrating with XDG portals should verify their dependencies for similar vulnerabilities and avoid relying on non-cryptographic random functions for generating access tokens or secrets. Monitoring logs for unusual patterns of token usage may also help detect exploitation attempts before significant data loss occurs, although the primary defense remains timely patching of the desktop portal infrastructure.