Samsung Flow versions prior to 4.9.22.4 contain an improper authentication flaw that allows attackers who are adjacent to a device to access sensitive information. The vulnerability is a direct result of insecure handling of authentication credentials, which can be leveraged to read data that should be protected. As a result, unauthorized entities can obtain confidential or personal data from the target device.

The affected product is Samsung Mobile's Samsung Flow. All releases before version 4.9.22.4 are impacted and should be considered vulnerable until a fix is applied.

The CVSS score of 6.1 indicates a medium impact. EPSS score is <1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local or adjacent; an attacker must be physically nearby or connected to the same local network or Bluetooth range to exploit the flaw. Once authenticated improperly, the attacker can read the device's sensitive data.