Skip to content
OpenAdvisories

Vendor

aliasvault

5 known vulnerabilities.

Products

aliasvault 5 ghcr.io/aliasvault/aliasvault 1 ghcr.io/aliasvault/api 1 ghcr.io/lanedirt/aliasvault-api 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-94621

    AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

    AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when…

    aliasvault aliasvault ghcr.io/aliasvault/aliasvault ghcr.io/lanedirt/aliasvault-api
  • Medium 6.1
    CVE-2026-22694

    AliasVault is Missing Origin Validation in Android Passkey Credential Provider

    AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could a…

    aliasvault aliasvault