CVE-2026-22077 PUBLISHED

Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet

Assigner: OPPO
Reserved: 06.01.2026 Published: 27.04.2026 Updated: 27.04.2026

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber
CVSS Score: 5.6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	High	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	Active

CVSS 4.0

Product Status

Vendor	OPPO
Product	OPPO Wallet APP
Versions	Default: unaffected Version all is affected

References

https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016

Impacts

CAPEC-122 Privilege Abuse