| शीर्षक | AliasVault v0.25.3 Insecure Storage of Sensitive Information |
|---|
| विवरण | AliasVault version 0.25.3 for Android stored sensitive authentication and cryptographic data in plaintext in shared_prefs/aliasvault.xml. The application allowed backups (android:allowBackup="true") but only excluded credential_identities.xml from backup rules, leaving access tokens, refresh tokens, key derivation parameters, and authentication data in cloud or device-transfer backups. An attacker who accessed a device backup or during device transfer could steal this sensitive data and compromise user accounts and active sessions. |
|---|
| स्रोत | ⚠️ https://github.com/aliasvault/aliasvault/issues/1497#issuecomment-3799836461 |
|---|
| उपयोगकर्ता | nmaochea (UID 95128) |
|---|
| सबमिशन | 11/02/2026 05:42 AM (8 महीनों पहले) |
|---|
| संयम | 22/02/2026 03:47 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347340 [AliasVault App तक 0.25.3 पर Android/iOS Backup aliasvault.xml सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|