CVE-2020-16272 | BDVDB-2026-139727 Detail

Description#

The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://forum.kee.pm/t/a-critical-security-update-for-keepassrpc-is-available/3040
https://danzinger.wien/exploiting-keepassrpc/

Exploit#

No public exploit known

History#

Version 12020-08-03Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.