Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-27606

Date: March 14, 2025

Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.

Severity Score

Related Resources (5)

https://github.com/element-hq/element-android/security/advisories/GHSA-632v-9pm3-m8ch
https://github.com/element-hq/element-android/commit/53bd78b05de375c6e6b0b5aa794a56b4ba95984c
https://github.com/element-hq/element-android/commit/87d7fcdc8036a4db4da8c403f87c73a64a546304
https://nvd.nist.gov/vuln/detail/CVE-2025-27606
https://www.mend.io/vulnerability-database/CVE-2025-27606

Severity Score

Weakness Type (CWE)

Exposure of Data Element to Wrong Session

CWE-488

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us