EUVD-2026-12305Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with redirect parameter
-
DeliverySend link to victim via social engineering
-
ExploitUser clicks link in Samsung Account
-
ExecutionRedirect to attacker's domain
-
ImpactAccess token captured from response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Samsung Account app version prior to 15.5.01.1. Victim must click attacker-controlled URL. Requires user interaction (UI:P). No authentication required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) indicates this is a network-exploitable vulnerability with low attack complexity but requires user interaction and has present attack requirements. The high confidentiality impact reflects the potential for access token theft. However, the lack of KEV listing suggests no known active exploitation in the wild. The requirement for user interaction (UI:P) and attack requirements (AT:P) reduce the likelihood of mass exploitation compared to fully automated attacks. This represents a moderate priority issue - serious enough to patch promptly but not an emergency unless you have evidence of targeted attacks against your users. |
| Exploit ScenarioDerived | An attacker crafts a malicious link that appears to direct to Samsung's login page but includes a redirect parameter pointing to an attacker-controlled server. When a victim clicks the link and successfully authenticates with their Samsung credentials, the authentication token is included in the redirect to the attacker's server, allowing account takeover. The attack requires convincing the user to click the malicious link through phishing emails, compromised websites, or social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
A URL redirection vulnerability in Samsung Account allows remote attackers to potentially steal user access tokens through malicious redirect chains. The vulnerability affects Samsung Account versions prior to 15.5.01.1 and requires user interaction to exploit. While not currently in CISA's Known Exploited Vulnerabilities catalog, the issue has a moderate CVSS score of 7.0 and could lead to account takeover if successfully exploited.
RemediationAI
Update Samsung Account to version 15.5.01.1 or later through your device's application update mechanism or Samsung Galaxy Store. For devices that cannot immediately update, users should be educated to carefully verify URLs before entering Samsung Account credentials and to only log in through official Samsung applications or trusted bookmarks. System administrators managing Samsung devices should prioritize this update in their patch management cycles and consider implementing email or SMS alerts to warn users about potential phishing attempts exploiting this vulnerability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability involves improper validation of redirect URLs in the Samsung Account authentication flow, allowing attackers to craft malicious URLs that redirect users to attacker-controlled domains after authentication. While no specific CWE is assigned, this appears to be a classic open redirect vulnerability typically classified under CWE-601 (URL Redirection to Untrusted Site). The vulnerability affects the Samsung Account application which handles authentication and authorization for Samsung services across mobile devices and web platforms.
Know when Samsung Account gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
URL redirection in Samsung Account prior to version 15.5.01.1 allows remote attackers to potentially get access token.
Executive ViewAI
A URL redirection vulnerability in Samsung Account could allow attackers to steal user credentials and gain unauthorized access to employee accounts. This poses a direct risk to organizational data and systems accessible through compromised Samsung accounts, requiring immediate mitigation until a patch becomes available.
Enable multi-factor authentication on all Samsung Accounts; implement email gateway filtering to block known malicious redirect domains; deploy user awareness training focused on URL validation and phishing indicators; enable enhanced logging and monitoring of Samsung Account authentication events; consider network segmentation to limit lateral movement from compromised accounts; restrict Samsung Account access to business-critical functions only where feasible; establish incident response procedures for account compromise scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB