CVE-2026-2974 affects AliasVault App versions 0.25.0 through 0.25.3 on Android and iOS platforms. The vulnerability involves the Backup Handler component improperly exposing sensitive backup files, specifically the shared_prefs/aliasvault.xml file, which contains API session tokens such as accessToken, refreshToken, metadata, key_derivation_params, and auth_methods. These tokens are intended for API session management and, due to the app's zero-knowledge encryption design, cannot decrypt the vault without the master password. However, their presence in backup files accessible to unauthorized local actors creates an exposure risk. The attack vector requires local access with low privileges and is considered highly complex to exploit, with no user interaction required. The vulnerability does not directly compromise vault contents but may allow attackers to leverage exposed tokens for session-related attacks or reconnaissance. The exploit code is publicly available, increasing the risk of exploitation despite the complexity. The issue is fixed in AliasVault App version 0.26.0 by removing these tokens from backups. The CVSS 4.0 base score is 2.0, reflecting low severity due to limited impact and high attack complexity.

The primary impact of this vulnerability is the unauthorized exposure of API session tokens stored in backup files, which could potentially be used by local attackers to gain limited session-related access or gather information about the victim's vault usage. Although the tokens alone cannot decrypt the vault without the master password, their compromise may facilitate further attacks such as session hijacking or targeted phishing. Organizations relying on AliasVault App for secure password management may face risks of partial credential exposure and reduced trust in backup confidentiality. The requirement for local access and high exploitation complexity limits the scope of impact, but insider threats or attackers with physical device access could exploit this vulnerability. The availability and integrity of the vault remain unaffected. Overall, the impact is low but non-negligible for environments with sensitive data and high security requirements.

To mitigate this vulnerability, organizations and users should upgrade the AliasVault App to version 0.26.0 or later, where the issue is resolved by removing sensitive API tokens from backup files. Additionally, enforce strict device access controls such as strong lock screens, biometric authentication, and encryption to prevent unauthorized local access. Regularly audit backup files and storage locations to ensure sensitive data is not inadvertently exposed. Educate users about the risks of local device compromise and encourage minimizing physical access by untrusted parties. Implement monitoring for unusual session activity that could indicate token misuse. For organizations deploying AliasVault in managed environments, consider restricting backup creation or storage on shared or insecure media. Finally, maintain up-to-date software and security patches to reduce exposure to known vulnerabilities.