CVE-2022-1955

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.

• CWE-287

• https://fluidattacks.com/advisories/tempest/Exploit, Issue Tracking, Third Party Advisory
• https://github.com/oxen-io/session-androidProduct, Third Party Advisory
• https://github.com/oxen-io/session-android/pull/897Exploit, Issue Tracking, Third Party Advisory
• https://fluidattacks.com/advisories/tempest/Exploit, Issue Tracking, Third Party Advisory
• https://github.com/oxen-io/session-androidProduct, Third Party Advisory
• https://github.com/oxen-io/session-android/pull/897Exploit, Issue Tracking, Third Party Advisory

Published

Jun 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1949An access control bypass vulnerability found in 389-ds-base.…7.5
• CVE-2022-1950The Youzify WordPress plugin before 1.2.0 does not sanitise …9.8
• CVE-2022-1951The core plugin for kitestudio WordPress plugin before 2.3.1…6.1
• CVE-2022-1952The Free Booking Plugin for Hotels, Restaurant and Car Renta…9.8
• CVE-2022-1953The Product Configurator for WooCommerce WordPress plugin be…9.1
• CVE-2022-1954A Regular Expression Denial of Service vulnerability in GitL…5.3
• CVE-2022-1956The Shortcut Macros WordPress plugin through 1.3 does not ha…4.3
• CVE-2022-1957The Comment License WordPress plugin before 1.4.0 does not h…4.3
• CVE-2022-1958A vulnerability classified as critical has been found in Fil…6.5
• CVE-2022-1959AppLock version 7.9.29 allows an attacker with physical acce…6.6
• CVE-2022-1960The MyCSS WordPress plugin through 1.1 does not have CSRF ch…4.3
• CVE-2022-1961The Google Tag Manager for WordPress (GTM4WP) plugin is vuln…4.8