Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Vulnerability in",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "duykham"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure,\n\nI would like to disclose a security vulnerability identified in a\nsmartphone application: *Koller Secret: Real Hidden App*.\n\nThis report is shared in the interest of responsible disclosure and\nimproving overall security awareness.\n\n---\n\n*Summary*\n- Application: Koller Secret: Real Hidden App\n- Package / Bundle ID: com.koller.secret.hidemyphoto\n- Platform: Android\n- Affected Version(s): v.1.0.27 and below\n- Vulnerability Type: Authentication Bypass\n- Severity: High\n- CVE: Pending\n\n---\n\n*Background*\nKoller Secret claims to be the \"first truly hidden app\" that has \"no\nvisible icon nor launcher\" and *can be accessed only by entering an Android\nsecret code* from the user\u0027s dial pad.\n\n---\n\n*Description*\nThe application contains a vulnerability that allows an attacker to *bypass\ntheir secret code mechanism* to access the app\u0027s main UI.\n\nThe root cause appears to be improper access control on an exported Android\ncomponent. The MainActivity is explicitly declared as\n`android:exported=\"true\"` in the Android manifest, making it accessible to\nexternal applications and enabling unauthorized activity invocation.\n\n---\n\n*Technical Details*\n- Relevant components:\n   - MainActivity / Android Manifest\n- Security mechanism affected:\n   - Access control\n\n*Observed behavior:*\nIt was observed that the application\u0027s MainActivity can be launched\nexternally via ADB by explicitly invoking it with the expected intent\naction (ACTION_LAUNCH). When started in this manner, the application\nbypasses the intended secret code verification mechanism and proceeds\ndirectly to the protected interface.\n\n*Expected behavior:*\nThe application should reject any attempts to launch the protected main\ninterface from external sources, including ADB or other applications.\nAccess to the protected interface should only be granted through the\nofficial application flow, which requires successful secret code entry via\nthe dial pad. All other invocation attempts should be denied.\n\n---\n\n*Proof of Concept (PoC)*\n1. Install \"Koller Secret: Real Hidden App\" version 1.0.27 (or earlier) to\nan Android smartphone.\n2. Connect the smartphone to a desktop machine (e.g., via a USB cable) that\nsupports Android Debug Bridge (ADB).\n3. Launch a command line terminal (or Command Prompt in Windows OS)\n4. Run the command:\n\nadb shell am start -n com.koller.secret.hidemyphoto/.MainActivity -a\ncom.koller.secret.hidemyphoto.ACTION_LAUNCH\n\n5. Observe that:\n- The main UI of Koller Secret app is loaded on the smartphone.\n- No secret code entry is required.\n\n**Important note**:\nThe Koller Secret Pro app (with more \"advanced security features\") is also\naffected by the vulnerability, when no lockscreen protection is enabled.\n\n---\n\n*Impact*\nAn attacker exploiting this vulnerability could potentially:\n- access sensitive user data\n- bypass security controls\n- compromise application integrity\n\nSuccessful exploitation of this issue undermine the application\u0027s intended\nsecurity model, potentially allowing unauthorized access to sensitive user\ndata and negatively impacting user trust in the application.\n\n---\n\n*Disclosure Timeline*\n- 2025.11.21 \u2013 Vulnerability discovered\n- 2025.11.25 \u2013 Vendor contacted\n- 2025.11.29 \u2013 Vendor acknowledged\n- 2025.12.29 \u2013 Public disclosure\n\nThe vendor was given reasonable time to respond prior to this disclosure.\nNo malicious exploitation is known at the time of publication.\n\n---\n\n*Mitigation / Recommendation*\nTo mitigate this issue, the affected activity should not be exported unless\nexplicitly required. Setting android:exported=\"false\" for the MainActivity\nwould prevent external invocation via ADB or third-party applications.\n\nIf exporting the activity is necessary, the application should enforce\nstrict access control by validating authorization state at runtime and\nensuring that the secret code verification has been successfully completed\nbefore granting access to protected functionality.\n\nUsers are advised to update to a fixed version once available.\n\n---\n\nDiscovered and reported by:\nduykham\n\n---\n\n*References*\n- Install:\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto\n- Install (Pro):\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro\n- Vendor: https://www.iotrusted.com\n\n---\n\nIf additional information is required, I can be reached privately.\n\nRegards,\nduykham\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:00:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/1"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.iotrusted.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability in Koller Secret: Real Hidden App (com.koller.secret.hidemyphoto)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0002",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1",
            "automated": true,
            "contentSha256": "f81787284493f3e97a5de826b1bc9e40b8479e55ec9a5f7da2ee9c5ee9a0c93c",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-29T21:09:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-11T11:00:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0002"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}