CVE-2026-94621
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts.
Risk Assessment
An attacker can perform internal network reconnaissance, obtaining timing and error information, and potentially access internal resources. This requires a publicly reachable instance with public registration enabled and an attacker-controlled DNS server.
Recommendation
Update AliasVault to version 0.30.3 or later, which fixes this vulnerability.
Other vulnerabilities in AliasVault
See all- CVE-2026-55587High
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide forged origin and relying-party values and, if a victim with a matching stored passkey approves the AliasVault passkey prompt, obtain a valid assertion for a different website. Exploitation requires the extension to be installed, unlocked, and configured as a passkey provider, requires a stored passkey for the impersonated site, and cannot occur silently because the victim must approve the prompt. The server, web application, and mobile applications are not affected. This issue is fixed in version 0.29.4.
- CVE-2025-59344High
AliasVault versions 0.23.0 and lower contain an SSRF vulnerability in the favicon extraction feature of the API. An authenticated low-privileged user can coerce the backend into making HTTP(S) requests to internal hosts and non-default ports, with responses potentially returned in Base64 form.
Original NVD description (English source)
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating an attacker-controlled authoritative DNS server can return a public address during validation and a private address during connection, causing a publicly reachable self-hosted server to issue HTTP or HTTPS requests to internal hosts. A valid image response is returned in Base64 form, while other responses can expose limited timing and error information for internal-network reconnaissance. Exploitation requires a publicly reachable self-hosted instance with public registration enabled, an authenticated AliasVault account, an attacker-controlled authoritative DNS server, and a resolver that permits rebinding; default checks limit requests to ports 80 and 443. The browser extensions, web application, and mobile applications are not affected. This issue is fixed in version 0.30.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS