CVE-2026-2974: Aliasvault Information Disclosure Flaw

CVE-2026-2974 Overview

CVE-2026-2974 affects the AliasVault mobile application versions up to 0.25.3 on Android and iOS. The vulnerability resides in the Backup Handler component, specifically the shared_prefs/aliasvault.xml file. The AliasVault app stored API session tokens, refresh tokens, key derivation parameters, and authentication metadata in a shared preferences file that was included in standard Android device backups. Because the application enabled android:allowBackup="true", an attacker with local access to backup data could extract these artifacts. This issue is classified under [CWE-285] Improper Authorization and is resolved in version 0.26.0.

Critical Impact
Local extraction of API session tokens from device backups. Per the vendor, AliasVault's zero-knowledge encryption design means these tokens cannot decrypt the vault without the master password, limiting direct compromise risk.

Affected Products

AliasVault App for Android up to version 0.25.3
AliasVault App for iOS up to version 0.25.3
Backup Handler component processing shared_prefs/aliasvault.xml

Discovery Timeline

2026-02-23 - CVE-2026-2974 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2974

Vulnerability Analysis

The AliasVault mobile app persisted sensitive runtime state in the Android shared preferences file aliasvault.xml. Stored values included accessToken, refreshToken, metadata, key_derivation_params, and auth_methods. The Android manifest declared android:allowBackup="true" and android:fullBackupContent="@xml/backup_rules", which permitted Android's auto-backup mechanism to include the shared preferences file in cloud or adb-captured backups. An attacker with local access to backup archives could read these tokens.

The vendor notes that AliasVault uses zero-knowledge encryption. The exposed tokens are API session credentials, not vault decryption keys. Decrypting stored credentials still requires the user's master password, which never leaves the device unencrypted.

Root Cause

The root cause is an insecure default backup configuration. The AliasVault Android manifest did not exclude session token storage from the platform backup scope. The legacy backup_rules.xml excluded only credential_identities.xml, leaving aliasvault.xml eligible for backup inclusion.

Attack Vector

Exploitation requires local access. An attacker must obtain a device backup archive through physical device access, an authenticated adb session with the device in developer mode, or compromised cloud backup credentials. The attack complexity is high and exploitability is rated difficult. Once extracted, tokens may be replayed against AliasVault API endpoints until they expire or are revoked.

xml

<!-- Patch: apps/mobile-app/android/app/src/main/AndroidManifest.xml -->
<!-- Before (vulnerable) -->
<application android:name=".MainApplication"
    android:allowBackup="true"
    android:fullBackupContent="@xml/backup_rules"
    android:dataExtractionRules="@xml/data_extraction_rules" ...>

<!-- After (fixed in 0.26.0) -->
<application android:name=".MainApplication"
    android:allowBackup="false"
    android:fullBackupContent="false"
    android:dataExtractionRules="@xml/data_extraction_rules" ...>

Source: GitHub Commit 873ecc0

Detection Methods for CVE-2026-2974

Indicators of Compromise

Presence of aliasvault.xml inside extracted Android backup archives (.ab files) or cloud backup snapshots for AliasVault versions at or below 0.25.3.
Unexpected API session activity originating from IP addresses or devices distinct from the user's registered device.
Use of adb backup commands targeting the net.aliasvault.app package on managed mobile devices.

Detection Strategies

Inventory mobile devices running AliasVault and identify installations at or below version 0.25.3.
Inspect mobile management telemetry for backup operations that include the AliasVault package.
Review AliasVault server-side authentication logs for refresh token use from new device fingerprints or geolocations.

Monitoring Recommendations

Forward mobile device management (MDM) and EMM logs into a centralized analytics platform to correlate backup events with account activity.
Alert on adb debugging enablement and backup commands against sensitive applications on enterprise-managed devices.
Monitor AliasVault API session creation patterns for anomalies indicating token replay.

How to Mitigate CVE-2026-2974

Immediate Actions Required

Upgrade the AliasVault mobile app to version 0.26.0 or later on all Android and iOS devices.
Rotate AliasVault API session tokens by signing out and signing back in after the upgrade to invalidate any tokens that may have been captured in prior backups.
Audit and delete existing AliasVault backup archives stored in Google Drive, iCloud, or local backup repositories.

Patch Information

The fix is delivered in AliasVault 0.26.0 via commits 873ecc03f92238e162f98a068ad56069a922b4f6 and 0bd662320174d8265dfe3b05a04bc13efc960532. The patch sets android:allowBackup="false" and android:fullBackupContent="false" in the Android manifest, excluding all AliasVault application data from platform backup mechanisms. Release details are available in the GitHub Release 0.26.0 and the corresponding GitHub Pull Request #1499.

Workarounds

Disable Android auto-backup for the AliasVault package through enterprise MDM policy until the upgrade is deployed.
Avoid enabling USB debugging or developer mode on devices where AliasVault is installed.
Restrict cloud account backup scope on managed devices to exclude the AliasVault application package.

bash

# Verify backup attributes on a managed Android device
adb shell dumpsys package net.aliasvault.app | grep -i backup

# Disable backup for the package via device policy (requires device owner)
adb shell bmgr enable false