AliasVault Android Passkey Validation Vulnerability Allowing Unauthorized Access

A vulnerability in AliasVault Android password manager versions 0.24.0 through 0.25.2 allowed malicious apps to request passkeys for unauthorized sites. This issue arose from incomplete validation of app identity and origin in the Android credential provider, potentially leading to unauthorized authentication if the user approved the request.

Impact

The vulnerability could be exploited by a malicious app to obtain passkeys for sites not authorized, potentially leading to unauthorized access or authentication.

Remediation

Users are advised to update AliasVault for Android to version 0.25.3 or later. This update is available on the Google Play Store, F-Droid, and as a manual APK download from the AliasVault website.