A flaw in the Nextcloud Android Files app allowed a user who had unlocked a previously locked device to bypass the app’s PIN by simply pressing the device’s back button. The vulnerability lets an attacker gain authenticated access to the app’s contents without providing the correct PIN, effectively nullifying the intended authentication protection.

The issue affects the Android Files app for all Nextcloud releases from version 33.0.0 up to, but not including, 33.1.0. The vulnerability is specific to the PassCodeActivity screen in these versions.

The CVSS score of 4.6 indicates a medium severity vulnerability. Because the exploit requires the device to be physically unlocked after a lock, it is a local attack vector and does not have a public remote exploit. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, any user who has enabled a PIN on the Nextcloud app faces the risk of letting an attacker bypass it by simply pressing the back button after unlocking the device.