{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22077", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "state": "PUBLISHED", "assignerShortName": "OPPO", "dateReserved": "2026-01-06T06:15:53.765Z", "datePublished": "2026-04-27T06:37:05.647Z", "dateUpdated": "2026-04-27T13:29:23.859Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2026-04-27T07:27:33.199Z"}, "title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet", "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"vendor": "OPPO", "product": "OPPO Wallet APP", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."}]}], "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "AUTOMATIC", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:19:04.793103Z", "id": "CVE-2026-22077", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:29:23.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:19:04.793103Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:19:05.812Z"}}], "cna": {"title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 5.6, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OPPO", "product": "OPPO Wallet APP", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "supportingMedia": [{"type": "text/html", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.", "base64": false}]}], "providerMetadata": {"orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "shortName": "OPPO", "dateUpdated": "2026-04-27T07:27:33.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22077", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:29:23.859Z", "dateReserved": "2026-01-06T06:15:53.765Z", "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695", "datePublished": "2026-04-27T06:37:05.647Z", "assignerShortName": "OPPO"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."}], "id": "CVE-2026-22077", "lastModified": "2026-04-27T18:57:20.293", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "security@oppo.com", "type": "Secondary"}]}, "published": "2026-04-27T08:16:01.120", "references": [{"source": "security@oppo.com", "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"}], "sourceIdentifier": "security@oppo.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "OPPO Wallet APP", "source": "cna", "vendor": "OPPO"}, "product": "wallet_app", "vendor": "oppo"}], "analysis": {"en": {"generated_at": "2026-04-28T04:45:25.101420+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s security patch for OPPO Wallet as soon as it becomes available.", "Employ network controls such as firewall rules or DNS filtering to block traffic from untrusted or spoofed domains that could reach the wallet service.", "In the interim, enforce frequent token rotation and monitor account activity for signs of hijacking, such as anomalous logins or token usage patterns."], "summary": {"action": "Monitor", "impact": "Sensitive Information Disclosure of Account Tokens"}, "threat_synthesis": {"affected_systems": "The flaw affects the OPPO Wallet APP as distributed by OPPO. No specific version information is supplied, so all releases of the wallet that rely on the same domain validation logic are susceptible until an update is issued.", "description_and_impact": "OPPO Wallet APP contains a trusted domain validation flaw that permits attackers to bypass protections on certain interfaces, which can enable the hijacking of account tokens and the disclosure of sensitive data. The vulnerability stems from inadequate verification of the domain that the request originates from, causing the application to incorrectly trust malicious traffic and expose privileged resources. At its core, the weakness allows a malicious actor to obtain credentials that are normally restricted to authenticated or trusted origins, thereby breaching confidentiality for affected users.", "risk_and_exploitability": "With a CVSS score of 5.6, the vulnerability is considered moderate in impact; however, the EPSS score of less than 1% indicates that exploit attempts are expected to be rare at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need to craft traffic that mimics a trusted domain or otherwise subvert the validation mechanism, which suggests a network\u2011based attack vector requiring the ability to send requests to the wallet service. The condition for exploitation is not obviously complicated, but because the flaw bypasses domain checks, it could be leveraged if an attacker can control the source of the request or the environment in which the wallet validates domains."}}}}, "created": "2026-04-27T19:51:35.039296+00:00", "updated": "2026-04-28T05:00:14.722804+00:00", "vendors": ["oppo", "oppo$PRODUCT$wallet_app"]}