CVE-2026-2974 Overview
A vulnerability was identified in AliasVault App up to version 0.25.3 on Android/iOS platforms. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml within the Backup Handler component. The manipulation of the arguments accessToken, refreshToken, metadata, key_derivation_params, and auth_methods leads to exposure of backup file to an unauthorized control sphere.
Critical Impact
Sensitive API session tokens and authentication metadata stored in the application's shared preferences can be inadvertently included in device backups, potentially exposing them to unauthorized access through backup extraction or cloud backup services.
Affected Products
- AliasVault App versions up to 0.25.3 (Android)
- AliasVault App versions up to 0.25.3 (iOS)
Discovery Timeline
- 2026-02-23 - CVE-2026-2974 published to NVD
- 2026-02-23 - Last updated in NVD database
Technical Details for CVE-2026-2974
Vulnerability Analysis
This vulnerability involves improper authorization (CWE-285) in the AliasVault mobile application's backup handling mechanism. The Android application was configured with android:allowBackup="true" and android:fullBackupContent="@xml/backup_rules", which permitted the inclusion of sensitive application data in Android device backups.
The shared_prefs/aliasvault.xml file contains API session tokens including accessToken and refreshToken, along with metadata, key derivation parameters, and authentication method configurations. When device backups were created (either locally via ADB or to cloud services), these sensitive tokens could be extracted by an attacker with local access to the backup data.
According to the software creator: "Because of AliasVault's zero-knowledge encryption design, the tokens stored in aliasvault.xml are API session tokens that cannot decrypt the vault on their own: the master password is required for that. So while this isn't a direct vault compromise risk, there's no reason to include them in backups either."
The attack requires local access and is considered to have high complexity, making exploitability difficult.
Root Cause
The root cause stems from insecure default Android application configuration where backup functionality was enabled without properly excluding all sensitive data files. The original backup_rules.xml only excluded credential_identities.xml from backups but failed to exclude the aliasvault.xml shared preferences file containing session tokens.
Attack Vector
The attack vector is local and requires the attacker to have physical access to the device or access to device backups. An attacker could extract the backup data using ADB backup commands or by accessing cloud backup services where device backups are stored. Once obtained, the shared preferences XML file could be parsed to extract the session tokens.
The following patch demonstrates how the vulnerability was addressed by disabling Android backup entirely for the AliasVault application:
<data android:scheme="https"/>
</intent>
</queries>
- <application android:name=".MainApplication" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:roundIcon="@mipmap/ic_launcher_round" android:allowBackup="true" android:fullBackupContent="@xml/backup_rules" android:dataExtractionRules="@xml/data_extraction_rules" android:theme="@style/AppTheme" android:supportsRtl="true" android:usesCleartextTraffic="true" android:localeConfig="@xml/locales_config" android:networkSecurityConfig="@xml/network_security_config">
+ <application android:name=".MainApplication" android:label="@string/app_name" android:icon="@mipmap/ic_launcher" android:roundIcon="@mipmap/ic_launcher_round" android:allowBackup="false" android:fullBackupContent="false" android:dataExtractionRules="@xml/data_extraction_rules" android:theme="@style/AppTheme" android:supportsRtl="true" android:usesCleartextTraffic="true" android:localeConfig="@xml/locales_config" android:networkSecurityConfig="@xml/network_security_config">
<meta-data android:name="expo.modules.updates.ENABLED" android:value="false"/>
<meta-data android:name="expo.modules.updates.EXPO_UPDATES_CHECK_ON_LAUNCH" android:value="ALWAYS"/>
<meta-data android:name="expo.modules.updates.EXPO_UPDATES_LAUNCH_WAIT_MS" android:value="0"/>
Source: GitHub Commit Update
Additionally, the backup_rules.xml file was removed entirely as backup is now completely disabled:
-<?xml version="1.0" encoding="utf-8"?>
-<!--
- Backup rules for Android API < 31 (Android 11 and below).
- Excludes sensitive credential identity data from device backups.
-
- The credential_identities file stores user metadata (usernames, email addresses, service names)
- that should not leave the device, matching iOS ASCredentialIdentityStore behavior which
- explicitly excludes its data from device backups.
-
- Security rationale:
- - Contains sensitive user information (though no passwords)
- - Should remain device-local for privacy
- - Can be re-synced from vault on new device
-->
-<full-backup-content>
- <!-- Exclude the credential identity store from backups -->
- <exclude domain="sharedpref" path="credential_identities.xml"/>
-</full-backup-content>
Source: GitHub Commit Update
Detection Methods for CVE-2026-2974
Indicators of Compromise
- Presence of aliasvault.xml file in device backup archives containing accessToken or refreshToken fields
- Unexpected ADB backup commands executed against devices with AliasVault installed
- Evidence of backup extraction from cloud backup services targeting AliasVault application data
Detection Strategies
- Monitor for ADB backup operations on mobile devices with AliasVault installed
- Review cloud backup access logs for unusual extraction of application-specific backup data
- Implement mobile device management (MDM) policies to audit backup configurations
Monitoring Recommendations
- Enable logging for backup-related operations on managed mobile devices
- Monitor for unauthorized access to cloud backup storage containing mobile device backups
- Implement SentinelOne Mobile Threat Defense to detect suspicious local access patterns
How to Mitigate CVE-2026-2974
Immediate Actions Required
- Upgrade AliasVault App to version 0.26.0 or later immediately
- Review and delete existing device backups that may contain the vulnerable application data
- Rotate API session tokens by logging out and logging back in after upgrade
- Audit backup access logs for any suspicious extraction attempts
Patch Information
The vulnerability has been addressed in AliasVault version 0.26.0. The fix involves two patch commits identified as 873ecc03f92238e162f98a068ad56069a922b4f6 and 0bd662320174d8265dfe3b05a04bc13efc960532. The patch completely disables Android backup functionality for the application by setting android:allowBackup="false" and android:fullBackupContent="false" in the AndroidManifest.xml.
For detailed patch information, see:
Workarounds
- Disable ADB debugging on devices to prevent local backup extraction
- Disable cloud backup for AliasVault application data in device settings until upgrade is applied
- Use mobile device management (MDM) policies to prevent unauthorized backup operations
# Verify AliasVault version on Android (ADB)
adb shell dumpsys package com.aliasvault.app | grep versionName
# Disable ADB backup capability (requires root or MDM)
adb shell settings put secure backup_enabled 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
