OPPO Wallet APP contains a trusted domain validation flaw that permits attackers to bypass protections on certain interfaces, which can enable the hijacking of account tokens and the disclosure of sensitive data. The vulnerability stems from inadequate verification of the domain that the request originates from, causing the application to incorrectly trust malicious traffic and expose privileged resources. At its core, the weakness allows a malicious actor to obtain credentials that are normally restricted to authenticated or trusted origins, thereby breaching confidentiality for affected users.

The flaw affects the OPPO Wallet APP as distributed by OPPO. No specific version information is supplied, so all releases of the wallet that rely on the same domain validation logic are susceptible until an update is issued.

With a CVSS score of 5.6, the vulnerability is considered moderate in impact; however, the EPSS score of less than 1% indicates that exploit attempts are expected to be rare at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need to craft traffic that mimics a trusted domain or otherwise subvert the validation mechanism, which suggests a network‑based attack vector requiring the ability to send requests to the wallet service. The condition for exploitation is not obviously complicated, but because the flaw bypasses domain checks, it could be leveraged if an attacker can control the source of the request or the environment in which the wallet validates domains.