CVE-2025-56467 Summary: An authentication bypass vulnerability in the Axis mobile app allows unauthorized users to access sensitive account information, including account balances, transaction history, and other personal account details, without MPIN. Affected Versions: Axis Mobile 9.9 and later Vulnerability Details: An analysis of the Axis mobile app revealed an authentication bypass vulnerability that allows access to sensitive account information without successful login. Specifically, attackers can retrieve account balances, transaction history, and other personal account details by interacting with the app's UI, even if authentication is not completed. Impact: This vulnerability allows unauthorized users to access sensitive account information, including account balances, transaction history, and other personal details, without successful authentication. Exploitation of this flaw could lead to privacy violations, financial data exposure, identity theft, and potential financial fraud. It undermines user trust and may have regulatory and reputational consequences for the affected organization. Proof of Concept: 1. Open AXIS mobile app > Pay to contacts > Press back button > Observe UPI Service in UI. 2. In UI you can access Check Balance, My Transactions, Manage UPI and Other services without MPIN. Credits: Discovered by Dewanand Vishal (dewcode) References: https://nvd.nist.gov/vuln/detail/CVE-2025-56467 https://www.cve.org/CVERecord?id=CVE-2025-56467