CVE-2025-21615: AAT allows data exfiltration by other apps installed on the same device

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-06 · updated 2026-06-17
Weakness: CWE-200

Description

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

Affected products

bailuk AAT: before 1.26

References

https://github.com/bailuk/AAT/security/advisories/GHSA-pwpm-x58v-px5c

Get alerted when CVE-2025-21615 or the next vulnerability affects your stack