What’s Vulnerable › Vulnerabilities

CVE-2022-1955

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-30 · updated 2026-06-17
• Weakness: CWE-287

Description

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.

Affected products

• Session: 1.13.0

References

• https://fluidattacks.com/advisories/tempest/
• https://github.com/oxen-io/session-android
• https://github.com/oxen-io/session-android/pull/897
• https://fluidattacks.com/advisories/tempest/
• https://github.com/oxen-io/session-android
• https://github.com/oxen-io/session-android/pull/897

Get alerted when CVE-2022-1955 or the next vulnerability affects your stack