Element Android PIN Autologout Bypass Vulnerability

A vulnerability exists in Element Android, a Matrix client, in versions through 1.6.32. Under certain conditions, the application may fail to log out a user after multiple incorrect PIN entries. This flaw can be exploited by an attacker with physical access to the device to guess the PIN. The issue is resolved in version 1.6.34.

Impact

Exploitation of this vulnerability allows for unauthorized PIN guessing, potentially leading to unauthorized access.

Reproduction

To reproduce this vulnerability, enter an incorrect PIN multiple times, exceeding the application's configured limit. After the maximum number of incorrect attempts, the application may not log out the user as expected, leaving the PIN entry vulnerable to further guessing attempts.

Remediation

Users can update to Element Android version 1.6.34 or later to address this vulnerability.