CVE-2025-57197 describes an improper access control vulnerability (CWE-284) in Payeer Android app version 2.5.0. The issue occurs in the authentication flow for changing the PIN, where a local attacker with root access can dynamically instrument the app to bypass the PIN verification check. This enables the attacker to directly modify the authentication PIN without knowledge of the current PIN, undermining the app's security controls. The vulnerability requires local high privileges (root) and does not involve user interaction. No known exploits in the wild have been reported. No patch or remediation information is currently provided.

An attacker with root access to the device can bypass PIN verification and change the authentication PIN, allowing unauthorized access to the user's account or funds protected by the PIN. This compromises confidentiality and integrity of the authentication mechanism. Availability is not affected. The attack requires local high privileges, limiting remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running the app on rooted devices or devices with compromised security. Restricting root access and monitoring device integrity can reduce risk. No official patch or workaround has been provided at this time.