CVE-2025-27606
Element Android PIN autologout bypass
- State
- Published
- Severity
- 5.1 Medium
- Published
- Mar 14, 2025
- Updated
- Mar 14, 2025
- Reserved
- Mar 3, 2025
Description
Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.1 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-488 Exposure of Data Element to Wrong Session
Affected Products
| Product | Versions |
|---|---|
element-androidelement-hq |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.