AliasVault is a privacy‑first password manager that provides an Android credential provider for passkey requests. In versions 0.24.0 through 0.25.2 the provider did not fully validate the calling app’s identity, origin, and RP ID, allowing a malicious local Android app to obtain a passkey response for a site it was not authorized to access. This omission is a broken validation vulnerability (CWE‑346) that can expose user credentials and compromise confidentiality.

AliasVault Android application, versions 0.24.0 to 0.25.2 (vendor: AliasVault)

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious app to run on the same device and to trigger a passkey request; the attacker can then receive a passkey response for a site it was not authorized to access, effectively bypassing normal authorization controls.