CVE-2021-43849

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

• CWE-617

• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569dfPatch, Third Party Advisory
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1Release Notes, Third Party Advisory
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8Mitigation, Third Party Advisory
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569dfPatch, Third Party Advisory
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1Release Notes, Third Party Advisory
• https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8Mitigation, Third Party Advisory

Published

Dec 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43843jsx-slack is a package for building JSON objects for Slack b…7.5
• CVE-2021-43844MSEdgeRedirect is a tool to redirect news, search, widgets, …8.8
• CVE-2021-43845PJSIP is a free and open source multimedia communication lib…9.1
• CVE-2021-43846`solidus_frontend` is the cart and storefront for the Solidu…4.3
• CVE-2021-43847HumHub is an open-source social network kit written in PHP. …6.5
• CVE-2021-43848h2o is an open source http server. In code prior to the `8c0…5.9
• CVE-2021-4385The WP Private Content Plus plugin for WordPress is vulnerab…4.3
• CVE-2021-43850Discourse is an open source platform for community discussio…6.8
• CVE-2021-43851Anuko Time Tracker is an open source, web-based time trackin…8.8
• CVE-2021-43852OroPlatform is a PHP Business Application Platform. In affec…8.8
• CVE-2021-43853Ajax.NET Professional (AjaxPro) is an AJAX framework availab…5.4
• CVE-2021-43854NLTK (Natural Language Toolkit) is a suite of open source Py…7.5