endpoint-software-vulnerabilityidentity-authentication-vulnerabilitycredential-access-methodcloud-service-vulnerability

OnePlus 13R OEM App Flaw Exposes Cloud Sessions to Malicious Apps

Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 10, 2026

A high-severity flaw in the preinstalled com.oneplus.account app on OnePlus 13R devices allows any installed malicious app to obtain an authenticated OnePlus Cloud session token. The exported OPAccountProvider content provider relies on com.oneplus.account.READ_ACCOUNT_INFO, a permission that third-party apps can declare because it is not restricted to software signed by OnePlus; an app can then invoke get_account_oneplus_token to retrieve oldSecondaryToken without user interaction beyond installation.

The exposed token was accepted by the OnePlus Cloud API and was demonstrated to enable modification of victim account data, creating a path to account session takeover. Doyensec confirmed the token exposure remained in firmware CPH2691_16.0.10.500(EX01) and disclosed the issue publicly after OnePlus had not remediated it.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 30, 2025 – Sep 10, 2026

Sep 10, 20262mo ago
Doyensec publicly discloses OnePlus session-takeover vulnerability
Doyensec publicly disclosed the unresolved OnePlus 13R OEM-app vulnerability, describing how a malicious installed app could obtain an authenticated OnePlus Cloud token without user interaction and impersonate the victim in cloud services.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Sep 9, 20262mo ago
Doyensec confirms flaw remains unresolved in latest firmware
Doyensec confirmed that an untrusted app could still extract a OnePlus account token from OPAccountProvider and that the token remained accepted by the OnePlus Cloud API. The researchers could not reproduce the prior account-data modification on the latest firmware because of regional-mechanism changes, but the underlying token exposure persisted.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Mar 12, 20268mo ago
OnePlus pays $720 bug bounty
A $720 bug bounty was paid for the reported OnePlus account-token exposure vulnerability.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Jan 6, 202610mo ago
OnePlus validates vulnerability and assigns high severity
OnePlus validated Doyensec's finding and assigned it a high-severity rating, after it had initially been reported as critical.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Dec 30, 202511mo ago
Doyensec reports OnePlus account-token exposure flaw
Doyensec disclosed the vulnerability to OnePlus, reporting that an untrusted installed application could access the exported OPAccountProvider and retrieve an authenticated OnePlus Cloud session token.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Organizations

2 linked

OneplusOnePlus Technology (Shenzhen) Co., Ltd.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Reddit NetsecCommunity · Sep 10, 2026

Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability : r/netsecOpen source ↗

Doyensec BlogNews · Sep 10, 2026

Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's BlogOpen source ↗

UnclassifiedNews · Mar 27, 2026

Android | Frida • A world-class dynamic instrumentation toolkitOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

endpoint-software-vulnerabilityidentity-authentication-vulnerabilitycredential-access-methodcloud-service-vulnerability

OnePlus 13R OEM App Flaw Exposes Cloud Sessions to Malicious Apps

Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 10, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 30, 2025 – Sep 10, 2026

Sep 10, 20262mo ago
Doyensec publicly discloses OnePlus session-takeover vulnerability
Doyensec publicly disclosed the unresolved OnePlus 13R OEM-app vulnerability, describing how a malicious installed app could obtain an authenticated OnePlus Cloud token without user interaction and impersonate the victim in cloud services.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Sep 9, 20262mo ago
Doyensec confirms flaw remains unresolved in latest firmware
Doyensec confirmed that an untrusted app could still extract a OnePlus account token from OPAccountProvider and that the token remained accepted by the OnePlus Cloud API. The researchers could not reproduce the prior account-data modification on the latest firmware because of regional-mechanism changes, but the underlying token exposure persisted.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Mar 12, 20268mo ago
OnePlus pays $720 bug bounty
A $720 bug bounty was paid for the reported OnePlus account-token exposure vulnerability.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Jan 6, 202610mo ago
OnePlus validates vulnerability and assigns high severity
OnePlus validated Doyensec's finding and assigned it a high-severity rating, after it had initially been reported as critical.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog
Dec 30, 202511mo ago
Doyensec reports OnePlus account-token exposure flaw
Doyensec disclosed the vulnerability to OnePlus, reporting that an untrusted installed application could access the exported OPAccountProvider and retrieve an authenticated OnePlus Cloud session token.
Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's Blog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Organizations

2 linked

OneplusOnePlus Technology (Shenzhen) Co., Ltd.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Reddit NetsecCommunity · Sep 10, 2026

Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability : r/netsecOpen source ↗

Doyensec BlogNews · Sep 10, 2026

Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability · Doyensec's BlogOpen source ↗

UnclassifiedNews · Mar 27, 2026

Android | Frida • A world-class dynamic instrumentation toolkitOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

OnePlus 13R OEM App Flaw Exposes Cloud Sessions to Malicious Apps

How this story unfolded

Doyensec publicly discloses OnePlus session-takeover vulnerability

Doyensec confirms flaw remains unresolved in latest firmware

OnePlus pays $720 bug bounty

OnePlus validates vulnerability and assigns high severity

Doyensec reports OnePlus account-token exposure flaw

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Untrusted Android Apps Can Gain Root on OnePlus and OPPO Devices

Critical SMS/MMS Data Exposure Vulnerability in OnePlus OxygenOS Remains Unpatched

Debug Flag in Microsoft 365 Android Apps Exposed Account Tokens to Any App

OnePlus 13R OEM App Flaw Exposes Cloud Sessions to Malicious Apps

How this story unfolded

Doyensec publicly discloses OnePlus session-takeover vulnerability

Doyensec confirms flaw remains unresolved in latest firmware

OnePlus pays $720 bug bounty

OnePlus validates vulnerability and assigns high severity

Doyensec reports OnePlus account-token exposure flaw

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Untrusted Android Apps Can Gain Root on OnePlus and OPPO Devices

Critical SMS/MMS Data Exposure Vulnerability in OnePlus OxygenOS Remains Unpatched

Debug Flag in Microsoft 365 Android Apps Exposed Account Tokens to Any App