View Ridge Security
Back to Cyber Hose

OnePlus 13R OEM account app flaw lets any app steal cloud session

OnePlus 13R session token theft leads this run, alongside WatchGuard RCE ransomware exploitation and Cisco FMC exploitation warnings.

🕵️ RESEARCH & DEEP DIVES

  • OnePlus 13R OEM account app flaw lets any app steal cloud session token
    Doyensec disclosed an unfixed OnePlus 13R vulnerability allowing any installed app to steal the user's OnePlus Cloud session token.

    • Affects OnePlus 13R phones running the com.oneplus.account OEM app; vendor rated the issue high severity and has not shipped a fix.
    • An exported content provider (com.oneplus.account.provider.open) is protected by com.oneplus.account.READ_ACCOUNT_INFO, which lacks signature-level protection, so any app can declare it and access the provider.
    • The get_account_oneplus_token command returns oldSecondaryToken, an authenticated OnePlus Cloud session token usable to impersonate the victim against the OnePlus Cloud API.
    • A PoC app with no user interaction stole the token and called the /uc/v1/user-info/update-real-name endpoint to modify victim data; requests require payload signing and encryption.
    • Doyensec analyzed 176 preinstalled APKs with 1,824 exported activities, using deobfuscation and Frida instrumentation of the OkHttp interceptor chain.
    Sources 📎 Coverage: blog.doyensec.com · 👁 via r/netsec

  • Building operational security architecture for long-term sustainability in UK SMEs
    A Security Boulevard commentary argues UK SMEs should replace piecemeal security fixes with a sustainable operational security architecture.

    • Applies to UK small and medium-sized enterprises whose security typically starts as separate fixes
    • Common patchwork includes password policies, backup tools, and aging firewalls set up years ago and never revisited
    • The piece advocates a unified operational security architecture for long-term sustainability
    Sources 📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)

  • CISA: WatchGuard RCE flaw now exploited in ransomware attacks — <https://www.bleepingcomputer.com/news/security/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks/|BleepingComputer>

  • Organizations Warned of Cisco Secure FMC Exploitation — <https://www.securityweek.com/organizations-warned-of-cisco-secure-fmc-exploitation/|SecurityWeek>

  • Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key — <https://thehackernews.com/2026/09/nearly-1-in-10-exposed-litellm-gateways.html|The Hacker News>

  • Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 — <https://thehackernews.com/2026/09/anthropic-ai-models-breached-real.html|The Hacker News>

  • The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE — <https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/|Palo Alto Unit 42>

  • Aruba HiSpeed Cache through 3.0.14 - Authenticated (Contributor+) Stored Cross-Sit... — <https://cve.threatint.com/CVE/CVE-2026-15889?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Redux Framework through 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site S... — <https://cve.threatint.com/CVE/CVE-2026-5399?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.... — <https://cve.threatint.com/CVE/CVE-2026-42808?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • A heap-based buffer overflow vulnerability in the PC bridge protocol decoder ... — <https://cve.threatint.com/CVE/CVE-2026-42807?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • An out-of-bounds read vulnerability was discovered in the Bosch BME690 Sensor... — <https://cve.threatint.com/CVE/CVE-2026-42806?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI... — <https://cve.threatint.com/CVE/CVE-2026-42805?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mou... — <https://cve.threatint.com/CVE/CVE-2026-88265?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Open Redirect in Armiya Information Technologies' Access Control SystemURL re... — <https://cve.threatint.com/CVE/CVE-2026-8323?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Crun: crun: /dev/console symlink follow allows root-owned file creation outsi... — <https://cve.threatint.com/CVE/CVE-2026-88264?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Arbitrary Code Execution in Gemini CLI via Symlinked Environment VariablesA v... — <https://cve.threatint.com/CVE/CVE-2026-13745?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exha... — <https://cve.threatint.com/CVE/CVE-2026-88290?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffer Overflows in VL... — <https://cve.threatint.com/CVE/CVE-2026-88289?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink C... — <https://cve.threatint.com/CVE/CVE-2026-88288?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame Overflow Denial ... — <https://cve.threatint.com/CVE/CVE-2026-88287?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Crun: crun: rootful krun with passt executes container payload as host rootA ... — <https://cve.threatint.com/CVE/CVE-2026-84042?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of ServiceGeoVis... — <https://cve.threatint.com/CVE/CVE-2026-88286?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - Unauthenticated PTZ Control ServiceGeoVision GV-LPC2211 ... — <https://cve.threatint.com/CVE/CVE-2026-88285?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Deni... — <https://cve.threatint.com/CVE/CVE-2026-88284?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow ... — <https://cve.threatint.com/CVE/CVE-2026-88283?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware — <https://cybersecuritynews.com/fake-claude-and-chatgpt-installers/|Cyber Security News>

  • Security researchers have found a cross-tenant vulnerability in Amazon Athena, AWS's serverless SQL service, that... — <https://mastodon.social/@campuscodi/117246277917200647|@campuscodi@mastodon.social>

  • Agentic AI Security: Key Findings from New IDC Research on the Identity Control Plane — <https://securityboulevard.com/2026/09/agentic-ai-security-key-findings-from-new-idc-research-on-the-identity-control-plane/|securityboulevard.com (discovered)>

  • B2B SaaS Product Launch Email: Tips & Examples — <https://securityboulevard.com/2026/09/b2b-saas-product-launch-email-tips-examples/|securityboulevard.com (discovered)>

  • Check out today's Metacurity to stay ahead of yesterday's sprawling set of infosec developments, including --US... — <https://infosec.exchange/@metacurity/117246211560618504|@metacurity@infosec.exchange>

  • Unauthenticated SQL Injection in SP Property Finder found by mySites.guru — <https://mysites.guru/blog/sp-property-finder-sql-injection-disclosure/|mysites.guru (discovered)>

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check