CVE-2025-27606

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27606
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27606.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27606
Aliases
  • GHSA-632v-9pm3-m8ch
Published
2025-03-14T16:56:23.217Z
Modified
2026-04-10T05:24:10.244120Z
Severity
  • 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Element Android PIN autologout bypass
Details

Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-488"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27606.json"
}
References

Affected packages

Git / github.com/element-hq/element-android

Affected ranges

Type
GIT
Repo
https://github.com/element-hq/element-android
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88d59e9db698dcc5944f4e8eef0273dd557abc34

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.14.3
v0.15.0
v0.16.0
v0.17.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.9.0
v0.9.1
v0.91.3-beta
v0.91.4-beta
v0.91.5
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.10
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.7-RC2
v1.3.8
v1.3.9
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.16
v1.4.18
v1.4.19
v1.4.2
v1.4.20
v1.4.22
v1.4.24
v1.4.25
v1.4.26
v1.4.27
v1.4.27-RC2
v1.4.28
v1.4.30
v1.4.31
v1.4.32
v1.4.34
v1.4.36
v1.5.0
v1.5.1
v1.5.10
v1.5.11
v1.5.12
v1.5.13
v1.5.14
v1.5.16
v1.5.18
v1.5.2
v1.5.20
v1.5.22
v1.5.24
v1.5.25
v1.5.26
v1.5.28
v1.5.30
v1.5.32
v1.5.4
v1.5.6
v1.5.7
v1.5.8
v1.6.0
v1.6.1
v1.6.10
v1.6.12
v1.6.14
v1.6.16
v1.6.18
v1.6.2
v1.6.20
v1.6.22
v1.6.24
v1.6.26
v1.6.28
v1.6.3
v1.6.30
v1.6.32
v1.6.5
v1.6.6
v1.6.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27606.json"