CVE-2026-2974

CVE-2026-2974 is a local vulnerability in AliasVault App versions up to 0.25.3 on Android/iOS, where sensitive API session tokens in the shared_prefs/aliasvault.xml file can be exposed through backup manipulation. While this exposure does not directly compromise the encrypted vault (which requires the master password), it could allow an attacker with local access to gain unauthorized control over API sessions. The attack is considered difficult to exploit due to high complexity, but a public exploit exists. Despite the public exploit, there is no evidence of active exploitation or significant community discussion, and it is not listed in CISA's KEV catalog.