Description
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| KDE | KDE Connect protocol | 8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnome-shell-extension-gsconnect | 71-1 | — |
| Debian 14 | kdeconnect | 25.11.80+git20251121.7090b106-1 | — |
| Debian 13 | gnome-shell-extension-gsconnect | 62-1+deb13u1 | DSA-6066-1 |
| Debian 13 | kdeconnect | 25.04.2-1+deb13u1 | DSA-6063-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | gnome-shell-extension-gsconnect | No fix yet | — |
| Ubuntu 25.10 | kdeconnect | 25.08.1-0ubuntu2.1 | USN-7905-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kdeconnect-kde | 25.11.90-1.1 | openSUSE-SU-2025:15800-1 |
Advisories 4
- USN-7905-1 kdeconnect vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15800-1 kdeconnect-kde-25.11.90-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-6066-1 gnome-shell-extension-gsconnect - security update Debian Security (DSA / DLA) · Nov 30, 2025
- DSA-6063-1 kdeconnect - security update Debian Security (DSA / DLA) · Nov 26, 2025
References
- https://invent.kde.org/network/kdeconnect-kde/-/commit/4e53bcdd5d4c28bd9fefd114b807ce35d7b3373e
- https://invent.kde.org/network/kdeconnect-android/-/commit/675d2d24a1eb95d15d9e5bde2b7e2271d5ada6a9
- https://invent.kde.org/network/kdeconnect-ios/-/commit/6c003c22d04270cabc4b262d399c753d55cf9080
- https://github.com/GSConnect/gnome-shell-extension-gsconnect/commit/a38246deec0af50ae218cdc51db32cdd7eb145e3
- https://github.com/andyholmes/valent/commit/85f773124a67ed1add79e7465bb088ec667cccce
- https://kde.org/info/security/advisory-20251128-1.txt