Samsung Pass
CVE-2021-25505
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.
AnalysisAI
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. Affected products include: Samsung Samsung Pass. Version information: prior to 3.0.02.4.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
More in Samsung Pass
View allImproper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data
Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authen
Improper exception handling in Samsung Pass prior to version 3.7.07.5 allows physical attacker to view the screen that i
Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access acc
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today