privacyIDEA Authenticator OTP Seed Disclosure via Local Root (CVE-2025-61482)

Key Information Vulnerability Description CVE ID: CVE-2025-61482 Vulnerability Type: privacyIDEA Authenticator OTP Seed Disclosure Impact: Local privilege escalation → OTP seed disclosure → Generation of valid OTP → Potential 2FA bypass Attack Prerequisites The attacker must have root or equivalent local code execution privileges on the target device. Affected Versions privacyIDEA Authenticator 4.3.0 (tested on Android 11) No patched version was available at the time of analysis. Mitigation Measures Treat compromised or breached devices as untrusted. Enforce device integrity checks (e.g., MCM or Play Integrity API). Use hardware-backed, non-exportable keys or external tokens to store OTP seeds, preventing plaintext exposure. CWE Classifications CWE-922: Insecure Storage of Sensitive Information CWE-522: Insufficient Protection of Credentials CWE-200: Exposure of Sensitive Information to Unauthorized Actors Proof of Concept (PoC) Install Frida or equivalent hooking tool to perform equivalent hooking. Launch or attach to the privacyIDEA Authenticator process ( ). Inject a hook script (or equivalent, non-displayed hook) that hooks cryptographic functions and captures plaintext buffers when the application accesses decrypted stored seeds. Results The PoC successfully recovers the seed after registration and demonstrates persistent secrets stored in plaintext are retrievable even after the app is closed. This attack does not require the app to actively decode a QR code or input a seed via the registration UI. CVSS Score Suggested CVSS v3.1 Vector (Base): AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N = 6.8 Suggested CVSS v4.0 Vector (Base, approximate): AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N = 6.6 Attack Vector (AV) Local (L) — Attacker must execute code on the device. Attack Complexity (AC) High (H) — Successful exploitation requires a compromised device and knowledge of runtime instrumentation. Required Privileges (PR) High (H) — Attacker needs high privileges (root) to inject Frida into processes in a typical Android configuration. User Interaction (UI) None (N) — No further user interaction required once the device is compromised. Scope (S) Changed (C) — Loss of confidentiality of secrets may lead to takeover of external accounts and services (impact crosses component boundaries). Confidentiality (C) High (H) — Full disclosure of OTP/TOTP/HOTP seeds. Integrity (I) High (H) — Attacker can generate valid OTPs (logical integrity of 2FA is broken). Availability (A) None (N) — The vulnerability does not directly impact availability. Discoverers Oliver Bölin and Philippe Van Daële References DIVA Research Paper (concept and analysis summary): https://www.diva-portal.org/smash/get/diva2:13A/B864dOKGwv77/pdf DIVA Research Paper PDF: https://www.diva-portal.org/smash/get/diva2:13B9d9O7/-JULLEX101.pdf Research Article/Abstract: https://svarthatt.se/cve/cve-2025-61482-pulling-otp-secrets-from-privacyidea-authenticator/

Goal Reached Thanks to every supporter — we hit 100%!

privacyIDEA Authenticator OTP Seed Disclosure via Local Root (CVE-2025-61482)