Medium severity · published Mar 14, 2025
CVE-2025-27606
Element Android PIN autologout bypass
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
element-android · element-hq
< 1.6.34 · source: vendor
EL
Element · Element
before 1.6.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27606
Patch
https://github.com/element-hq/element-android/commit/53bd78b05de375c6e6b0b5aa794a56b4ba95984c
Patch
https://github.com/element-hq/element-android/commit/87d7fcdc8036a4db4da8c403f87c73a64a546304
Vendor Advisory
https://github.com/element-hq/element-android/security/advisories/GHSA-632v-9pm3-m8ch
More from element-android
7.8
CVE-2024-26131
Element Android Intent Redirection
3.3
CVE-2024-26132
Element Android can be asked to share internal files.