element-hq element-android up to 1.6.33 wrong session

Summaryinfo

A vulnerability labeled as problematic has been found in element-hq element-android up to 1.6.33. This vulnerability affects unknown code. Executing a manipulation can lead to wrong session. The identification of this vulnerability is CVE-2025-27606. The attack can only be executed locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in element-hq element-android up to 1.6.33. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a wrong session vulnerability. The CWE definition for the vulnerability is CWE-488. The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-27606 since 03/03/2025. The exploitation appears to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.6.34 eliminates this vulnerability. Applying the patch 53bd78b05de375c6e6b0b5aa794a56b4ba95984c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• element-hq

Name

• element-android

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.6.20
• 1.6.21
• 1.6.22
• 1.6.23
• 1.6.24
• 1.6.25
• 1.6.26
• 1.6.27
• 1.6.28
• 1.6.29
• 1.6.30
• 1.6.31
• 1.6.32
• 1.6.33

License

• open-source

Website

• Product: https://github.com/element-hq/element-android/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion