CVE-2026-22077
Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
- Record
CVE-2026-22077- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2026-25784
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
- Record
EUVD-2026-25784- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xfph-rv9m-8p8r
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass...
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
- Record
GHSA-xfph-rv9m-8p8r- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
- Record
CVE-2026-22077- CVSS 4.0
- 5.6 Medium
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-346
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22077 is a medium vulnerability (CVSS 5.6) in Oppo Wallet App, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.08%, the 0th percentile. No source names a fixed version.