aliasvault vulnerabilities

Products

• aliasvault 6
• ghcr.io/aliasvault/aliasvault 1
• ghcr.io/aliasvault/api 1
• ghcr.io/lanedirt/aliasvault-api 1

Latest aliasvault CVEs

Newest publication first

1. CVE-2026-94621 AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

   Published 2026-10-15

   Medium·CVSS 6.3 EPSS 0.19%

   AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authe...

2. CVE-2026-55587 AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID

   Published 2026-10-15

   High·CVSS 8.1 EPSS 0.15%

   AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current we...

3. CVE-2026-26266 AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering

   Published 2026-03-03

   Medium·CVSS 6.1 EPSS 0.28%

   AliasVault is a privacy-first password manager with built-in email aliasing. A stored cross-site scripting (XSS) vulnerability was identified in the email rendering feature of AliasVault Web Client versions 0.25.3 and lower. When viewing received emails on an alias, the HTML cont...

4. CVE-2026-2974 AliasVault App Backup aliasvault.xml backup

   Published 2026-02-23

   Low·CVSS 2.0 EPSS 0.11%

   A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. This vulnerability affects unknown code of the file shared_prefs/aliasvault.xml of the component Backup Handler. The manipulation of the argument accessToken/refreshToken/metadata/key_derivation_params/...

5. CVE-2026-22694 AliasVault is Missing Origin Validation in Android Passkey Credential Provider

   Published 2026-01-14

   Medium·CVSS 6.1 EPSS 0.14%

   AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a pa...

6. CVE-2025-59344 AliasVault Vulnerable to Server-Side Request Forgery via Favicon Extraction

   Published 2025-09-19

   High·CVSS 7.7 EPSS 0.33%

   AliasVault is a privacy-first password manager with built-in email aliasing. A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature of AliasVault API versions 0.23.0 and lower. The extractor fetches a user-supplied URL, parses the returned HTM...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.