CVE-2025-57197

In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature

Medium · published September 29, 2025

CVSS v3.1
6.0
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This allows unauthorized users to change PIN without knowing the original/current PIN.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00169 · 6.0th percentile
Published
2025-09-29T00:00Z
EPSS history
Timeline
  • 29 SEP 00:00Z
    In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature
    cvelistv5