OnePlus 13R Preinstalled Account App Leaks Cloud Session Tokens to Any App Declaring Required Permission
Researchers from Doyensec have discovered a vulnerability in the preinstalled software on the OnePlus 13R that allows a third-party application to steal a valid OnePlus Cloud session token. The issue resides in the com.oneplus.account application responsible for managing authentication to the manufacturer’s services.
The exposed component OPAccountProvider is protected by the permission com.oneplus.account.READ_ACCOUNT_INFO. However, developers failed to set protectionLevel="signature", which would have restricted access exclusively to applications signed by OnePlus. As a result, any third-party application can simply declare the same permission in its manifest and query the provider.
Upon receiving a specific command, the provider returns the active OnePlus Cloud session token. No pop-up dialogs, security warnings, or explicit user consent are required. In the initial proof-of-concept, researchers used the stolen token to call OnePlus Cloud APIs and modify the victim’s personal data.
Doyensec reported the vulnerability to OnePlus on 30 December 2025. The vendor acknowledged the issue, rated its severity as high, and paid the researchers $720 in March 2026. A patch, however, has been slow to arrive.
In September, re-testing on firmware CPH2691_16.0.10.500(EX01) confirmed that an untrusted application can still obtain the token and that the regional API continues to accept it. Full reproduction of account data changes for US and EMEA accounts was no longer possible due to service-side modifications, meaning token leakage remains while complete account takeover on the latest version has not been verified.
Users are recommended to avoid installing applications from untrusted sources and to monitor for updates. OnePlus simply needs to add the single word “signature” to the permission definition to resolve the exposure.
Related articles
Exploiting CVE-2025-55182 React2Shell Vulnerability on Hack The Box Reactor Machine
A detailed walkthrough demonstrates remote code execution against a seasonal Hack The Box machine named Reactor by abusing the critical Next.js deserialization flaw CVE-2025-55182, also known as React2Shell. The attack begins with Nmap reconnaissance revealing an exposed Next.js service on port 3000, followed by Wappalyzer identification of an outdated framework version. Public exploit code is used to obtain an initial reverse shell as the node user without authentication. Credential access is achieved by extracting password hashes from the reactor.db SQLite database and cracking the engineer account with Hashcat against rockyou.txt. Privilege escalation leverages an exposed Node.js Inspector debug port on 9229, allowing WebSocket interaction via websocat to set the SUID bit on /bin/bash and obtain root access. The article highlights both the impact of the unauthenticated RCE vulnerability and common misconfigurations such as forgotten debug ports on production systems.
CISA Adds MikroTik RouterOS Flaws CVE-2026-67277 and CVE-2026-86060 to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities in MikroTik RouterOS to its Known Exploited Vulnerabilities Catalog. CVE-2026-86060 stems from improper sanitization of command argument delimiters and can lead to privilege escalation after an attacker gains access to the SSH login helper and alters trusted policy masks. CVE-2026-67277 involves missing authentication checks in critical RouterOS functions, allowing connections before authentication completes and potentially leaking kernel memory or causing denial-of-service conditions. CISA directed US federal agencies to apply mitigations by September 13 and specifically investigate any signs of compromise related to CVE-2026-86060. The agency noted that the flaws carry broader exploitation risk and urged all organizations using affected MikroTik products to take immediate action.
The Birth of CVE: How Two MITRE Engineers Built the Universal Vulnerability Identifier in 1999
In the late 1990s, security teams faced chaos with one vulnerability carrying dozens of incompatible names across scanners, IDS tools, and CERT advisories. Two MITRE engineers, David E. Mann and Steven M. Christey, proposed a minimal Common Vulnerabilities and Exposures list to solve correlation problems without imposing taxonomy or risk models. Their January 1999 paper led to a Purdue workshop, the formation of the CVE Editorial Board, and a public launch on September 29, 1999, with 321 initial entries. The design deliberately avoided ownership by any vendor and kept names as simple CVE-year-number strings. This neutral, open approach allowed competing vendors to map their proprietary databases to a shared reference without agreeing on classifications. The same minimalist philosophy later influenced NVD, OSV, and GitHub Advisory Database.
Microsoft Fixes Remote Code Execution Flaw in Windows Remote Desktop Client
Microsoft has addressed a remote code execution vulnerability in the Windows Remote Desktop Client tracked as CVE-2026-69485 with a CVSS score of 8.8. The flaw stems from the use of an uninitialized resource and can be triggered by a specially crafted network request from an authenticated attacker with low privileges. Exploitation requires no user interaction such as clicking links or opening files and can lead to information disclosure, file modification, or service disruption. Multiple versions of Windows 10, Windows 11, and Windows Server 2016 through 2025 are affected, including Server Core installations. The issue was not publicly disclosed prior to patching and no active exploitation has been observed. Fixes were released in the September security updates including KB5124008 and KB5122871.