CVE-2023-33293

An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.

• CWE-668

• https://kaios.dev/cve/1410290Exploit, Vendor Advisory
• https://kaios.dev/cve/1410290Exploit, Vendor Advisory

Published

May 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33287A stored cross-site scripting (XSS) vulnerability in the Inl…5.4
• CVE-2023-33288An issue was discovered in the Linux kernel before 6.2.9. A …4.7
• CVE-2023-33289The urlnorm crate through 0.1.4 for Rust allows Regular Expr…7.5
• CVE-2023-3329SpiderControl SCADA Webserver versions 2.08 and prior are vu…6.5
• CVE-2023-33290The git-url-parse crate through 0.4.4 for Rust allows Regula…7.5
• CVE-2023-33291In ebankIT 6, the public endpoints /public/token/Email/gener…7.4
• CVE-2023-33294An issue was discovered in KaiOS 3.0 before 3.1. The /system…9.8
• CVE-2023-33295Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered…6.5
• CVE-2023-33297Bitcoin Core before 24.1, when debug mode is not used, allow…7.5
• CVE-2023-33298com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on m…7.8
• CVE-2023-33299A deserialization of untrusted data in Fortinet FortiNAC bel…9.8
• CVE-2023-3330Improper Limitation of a Pathname to a Restricted Directory …4.3