The vulnerability resides in the integrity verification of the vault.cryptomator file used by Cryptomator for Android. In versions before 1.12.3 the application accepts the endpoint URLs listed in that file without performing host authenticity checks. An attacker who can alter the file can replace a legitimate Hub API URL with a malicious endpoint. When the client authenticates to the tampered endpoint it transmits the user’s access token, allowing the attacker to exfiltrate the token and later gain unauthorized access to the user’s cloud data.

All Android installations of Cryptomator older than 1.12.3 that are configured to use Hub for vaults are affected. Both the Android OS platform and any cloud provider accessed through the Hub API are impacted as long as the client trusts the modified configuration. The problem is confined to devices running the unpatched client.

The CVSS score of 7.6 classifies the flaw as high severity. The EPSS score is below 1 %, and it is not listed as a known exploited vulnerability. Based on the description, it is inferred that the attacker must have the ability to modify the vault.cryptomator file; this requirement implies that local access, a privilege‑elevating vulnerability, or another mechanism that grants write permissions would be needed. Once the file is altered, the attacker can perform a man‑in‑the‑middle attack and harvest authentication tokens. The lack of host verification allows the client to communicate with any URL specified in the file, making the vulnerability straightforward once the configuration is compromised.