CVE-2026-22077 - Vulnerability Details - OpenCVE

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.

Attack Vector Local

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016

History

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-346
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Apr 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
Title		Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
References		https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016
Metrics		cvssV4_0 `{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: OPPO

Published: 2026-04-27T06:37:05.647Z

Updated: 2026-04-27T13:29:23.859Z

Reserved: 2026-01-06T06:15:53.765Z

Link: CVE-2026-22077

Vulnrichment

Updated: 2026-04-27T13:19:05.812Z

NVD

Status : Received

Published: 2026-04-27T08:16:01.120

Modified: 2026-04-27T14:16:27.313

Link: CVE-2026-22077

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22077", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "state": "PUBLISHED", "assignerShortName": "OPPO", "dateReserved": "2026-01-06T06:15:53.765Z", "datePublished": "2026-04-27T06:37:05.647Z", "dateUpdated": "2026-04-27T13:29:23.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2026-04-27T07:27:33.199Z"}, "title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet", "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "OPPO", "product": "OPPO Wallet APP", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."}]}], "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "AUTOMATIC", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:19:04.793103Z", "id": "CVE-2026-22077", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:29:23.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:19:04.793103Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:19:05.812Z"}}], "cna": {"title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 5.6, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OPPO", "product": "OPPO Wallet APP", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "supportingMedia": [{"type": "text/html", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "base64": false}]}], "providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2026-04-27T07:27:33.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22077", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:29:23.859Z", "dateReserved": "2026-01-06T06:15:53.765Z", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "datePublished": "2026-04-27T06:37:05.647Z", "assignerShortName": "OPPO"}, "dataVersion": "5.2"}