CVE-2026-22694

Published: Jan 14, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Exploitability: 1.8 / Impact: 4.2

Source: NVD

Description

AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.

Affected (1)

Products: Aliasvault: Aliasvault

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Aliasvault Aliasvault	From 0.24.0 to 0.25.3

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (5)

https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d

Source: security-advisories@github.com

Patch

https://github.com/aliasvault/aliasvault/issues/1440

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/aliasvault/aliasvault/pull/1441

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/aliasvault/aliasvault/releases/tag/0.25.3

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q

Source: security-advisories@github.com

MitigationPatchVendor Advisory

Timeline

No history available yet.