CVE-2023-22473: Passcode bypass on Talk-Android app

Severity: low (CVSS 2.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-09 · updated 2026-06-17
Weakness: CWE-284

Description

Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2.

Affected products

Nextcloud Talk: before 15.0.2 — fixed in 15.0.2

How to fix

Upgrade to a fixed version: Nextcloud Talk 15.0.2. Check the vendor advisory for mitigations.

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx
https://github.com/nextcloud/talk-android/pull/2598
https://hackerone.com/reports/1784645
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx
https://github.com/nextcloud/talk-android/pull/2598
https://hackerone.com/reports/1784645

Get alerted when CVE-2023-22473 or the next vulnerability affects your stack