Refine your search
5 vulnerabilities found for aliasvault by aliasvault
CVE-2026-94621 (GCVE-0-2026-94621)
Vulnerability from cvelistv5
Published
2026-10-15 18:23
Modified
2026-10-16 17:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| aliasvault | aliasvault |
Version: < 0.30.3 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:54.558375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:11:53.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.3"
}
]
},
{
"product": "ghcr.io/aliasvault/aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.3"
}
]
},
{
"product": "ghcr.io/aliasvault/api",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.3"
}
]
},
{
"product": "ghcr.io/lanedirt/aliasvault-api",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.30.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:23:33.174Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-7hm6-fj4m-pf6f"
},
{
"name": "https://github.com/aliasvault/aliasvault/pull/2311",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/pull/2311"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/7eb4fee71f4582cfc80b8daea421b99d6aa9f814"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/90ea7d6bb4c74ca169ee1dde3ca38b08bd0966ed"
},
{
"name": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.30.3"
}
],
"source": {
"advisory": "GHSA-7hm6-fj4m-pf6f",
"discovery": "UNKNOWN"
},
"title": "AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-94621",
"datePublished": "2026-10-15T18:23:33.174Z",
"dateReserved": "2026-09-21T21:32:23.742Z",
"dateUpdated": "2026-10-16T17:11:53.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55587 (GCVE-0-2026-55587)
Vulnerability from cvelistv5
Published
2026-10-15 18:21
Modified
2026-10-28 20:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| aliasvault | aliasvault |
Version: < 0.29.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55587",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T20:01:18.638391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:01:30.746Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.29.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:21:53.069Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f99p-jfhr-6ffc"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/a60d0966e66ecf4f6558dc40e3feb1313072ce2b"
},
{
"name": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.29.4"
}
],
"source": {
"advisory": "GHSA-f99p-jfhr-6ffc",
"discovery": "UNKNOWN"
},
"title": "AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55587",
"datePublished": "2026-10-15T18:21:53.069Z",
"dateReserved": "2026-06-16T23:18:03.169Z",
"dateUpdated": "2026-10-28T20:01:30.746Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-26266 (GCVE-0-2026-26266)
Vulnerability from cvelistv5
Published
2026-03-03 22:16
Modified
2026-03-04 16:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.[
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| aliasvault | aliasvault |
Version: < 0.26.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-26266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T16:49:44.458482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T16:52:03.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML content is rendered in an iframe using srcdoc, which does not provide origin isolation. An attacker can send a crafted email containing malicious JavaScript to any AliasVault email alias. When the victim views the email in the web client, the script executes in the same origin as the application. No sanitization or sandboxing was applied to email HTML content before rendering. This vulnerability is fixed in 0.26.0.["
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T22:16:15.387Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f65p-p65r-g53q"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/382e2e96fa502891638a48404f6d82dc972ab481"
},
{
"name": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.26.0"
}
],
"source": {
"advisory": "GHSA-f65p-p65r-g53q",
"discovery": "UNKNOWN"
},
"title": "AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-26266",
"datePublished": "2026-03-03T22:16:15.387Z",
"dateReserved": "2026-02-12T17:10:53.412Z",
"dateUpdated": "2026-03-04T16:52:03.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22694 (GCVE-0-2026-22694)
Vulnerability from cvelistv5
Published
2026-01-14 16:32
Modified
2026-01-14 16:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| aliasvault | aliasvault |
Version: >= 0.24.0, < 0.25.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22694",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T16:59:17.521627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T16:59:24.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.24.0, \u003c 0.25.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T16:32:36.007Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-mvg4-wvjv-332q"
},
{
"name": "https://github.com/aliasvault/aliasvault/issues/1440",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/issues/1440"
},
{
"name": "https://github.com/aliasvault/aliasvault/pull/1441",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/pull/1441"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/b3350473103d6138ab2b63ca130c211717eac67d"
},
{
"name": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.25.3"
}
],
"source": {
"advisory": "GHSA-mvg4-wvjv-332q",
"discovery": "UNKNOWN"
},
"title": "AliasVault is Missing Origin Validation in Android Passkey Credential Provider"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22694",
"datePublished": "2026-01-14T16:32:36.007Z",
"dateReserved": "2026-01-08T19:23:09.855Z",
"dateUpdated": "2026-01-14T16:59:24.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59344 (GCVE-0-2025-59344)
Vulnerability from cvelistv5
Published
2025-09-19 15:21
Modified
2025-09-19 16:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows <link rel="icon" href="…">. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| aliasvault | aliasvault |
Version: < 0.23.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-19T16:08:22.765918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T16:08:33.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "aliasvault",
"vendor": "aliasvault",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTML, and follows \u003clink rel=\"icon\" href=\"\u2026\"\u003e. Although the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Even when no data is returned, timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances that are reachable from the public internet with public user registration enabled. Private/internal deployments without public sign-ups are not directly exploitable. This issue has been fixed in AliasVault release 0.23.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-19T15:21:19.533Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasvault/aliasvault/security/advisories/GHSA-f253-f7xc-w7pj"
},
{
"name": "https://github.com/aliasvault/aliasvault/pull/1226",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/pull/1226"
},
{
"name": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/commit/58c39815e4c8bb27a311c3b592d54e157b4e6968"
},
{
"name": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aliasvault/aliasvault/releases/tag/0.23.1"
}
],
"source": {
"advisory": "GHSA-f253-f7xc-w7pj",
"discovery": "UNKNOWN"
},
"title": "AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59344",
"datePublished": "2025-09-19T15:21:19.533Z",
"dateReserved": "2025-09-12T12:36:24.636Z",
"dateUpdated": "2025-09-19T16:08:33.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}