CVE-2020-12856

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.

• https://covidsafe.watch/issue-register/cve-2020-12856-long-term-tracking-and-possibly-enables-other-bluetooth-based-attack-vectorsThird Party Advisory
• https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharingThird Party Advisory
• https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.mdThird Party Advisory
• https://covidsafe.watch/issue-register/cve-2020-12856-long-term-tracking-and-possibly-enables-other-bluetooth-based-attack-vectorsThird Party Advisory
• https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharingThird Party Advisory
• https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.mdThird Party Advisory

Published

May 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
• CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
• CVE-2020-12852The update feature for Pydio Cells 2.0.4 allows an administr…6.8
• CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1
• CVE-2020-12854A remote code execution vulnerability was identified in SecZ…8.8
• CVE-2020-12855A Host header injection vulnerability has been discovered in…8.8
• CVE-2020-12857Caching of GATT characteristic values (TempID) in COVIDSafe …7.5
• CVE-2020-12858Non-reinitialisation of random data in the advertising paylo…7.5
• CVE-2020-12859Unnecessary fields in the OpenTrace/BlueTrace protocol in CO…5.3
• CVE-2020-1286A remote code execution vulnerability exists when the Window…8.8
• CVE-2020-12860COVIDSafe through v1.0.17 allows a remote attacker to access…5.3
• CVE-2020-12861A heap buffer overflow in SANE Backends before 1.0.30 allows…8.8