Threat reportVulnerabilityTL-2026-4852
OnePlus OEM App (com.oneplus.account) Exported Provider Exposes OnePlus Cloud Session Token – Session Takeover (Doyensec disclosure, unpatched)
OnePlus OEM App (com.oneplus.account) Exported Provider (TL-2026-4852), also tracked as OnePlus OPAccountProvider token exposure, is a high-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects OnePlus com.oneplus.account (preinstalled OEM account app, maps to 5 MITRE ATT&CK techniques (T1078.004, T1528, T1565.001), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4852
- Threat ID
- TL-2026-4852
- Also known as
- OnePlus OPAccountProvider token exposure
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
How OnePlus OEM App (com.oneplus.account) Exported Provider works
Doyensec reported that the preinstalled OnePlus account app (com.oneplus.account) on the OnePlus 13R exposes an authenticated OnePlus Cloud session token to any third-party app that declares a custom permission lacking signature-level protection. The issue was reported on 2025-12-30 and was still unpatched in a 2026-09-09 retest; technical details were temporarily withdrawn from the Doyensec post at the vendor's request.
Doyensec (researcher Szymon Drosdzol) analysed OEM applications preinstalled on the OnePlus 13R and found that the com.oneplus.account application exports a content provider, OPAccountProvider, that manages authentication for OnePlus services. Access to the provider is guarded by the custom permission com.oneplus.account.READ_ACCOUNT_INFO, but that permission is declared without android:protectionLevel="signature". Any third-party application can therefore declare the same permission in its manifest and is granted access without a user-facing warning.
When the provider receives the get_account_oneplus_token command it returns a token (the field is named oldSecondaryToken). Despite the name, this value is an active, authenticated OnePlus Cloud session credential. A malicious app holding only the INTERNET permission plus the custom OnePlus permission declaration can read it with zero further user interaction after installation, then replay it against the OnePlus Cloud API (host uc-client-fr.oneplus.com was shown to accept it) to impersonate the victim and read or modify account data. A reported example of a state-changing endpoint is /uc/v1/user-info/update-real-name, which allows silent alteration of the victim's personal data.
Disclosure timeline per secondary reporting: reported 2025-12-30 as critical; OnePlus confirmed on 2026-01-06 but downgraded the rating to high; a USD 720 bounty was awarded on 2026-03-12; the vulnerability was retested on 2026-09-09 on firmware CPH2691_16.0.10.500(EX01) and found still present. Doyensec published on 2026-09-10 and, after a last-minute vendor request, temporarily took the technical details offline and granted one final limited remediation window. Doyensec reported that regional API changes prevented end-to-end exploitation against US/EMEA accounts during the September 2026 retest, but the token exposure itself persisted.
No CVE, CVSS score, in-the-wild exploitation, public PoC, IOCs or threat-actor attribution is stated in the sources. The recommended fix is to apply android:protectionLevel="signature" to the custom permission so only OnePlus-signed apps can access the provider. Only the OnePlus 13R firmware above was explicitly confirmed vulnerable; other devices and versions were not stated in the sources.
MITRE ATT&CK techniques used in TL-2026-4852
Initial Access
T1078.004 Valid Accounts: Cloud Accounts
Credential Access
T1528 Steal Application Access Token
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
credential-access
T1635 Steal Application Access Token
Collection
Affected products and versions in OnePlus OEM App (com.oneplus.account) Exported Provider
- OnePlus — com.oneplus.account (preinstalled OEM account app, OPAccountProvider) on OnePlus 13R
Vulnerable versions: CPH2691_16.0.10.500(EX01)
Remediation for OnePlus OEM App (com.oneplus.account) Exported Provider
Patches
- No fix released as of 2026-09-10; OnePlus should declare com.oneplus.account.READ_ACCOUNT_INFO with android:protectionLevel="signature"
Immediate actions
- Install only trusted apps on OnePlus devices from reputable stores; review installed apps that declare com.oneplus.account.READ_ACCOUNT_INFO
- Monitor OnePlus Cloud account activity for unexpected profile changes (e.g. real-name updates)
Workarounds
- None vendor-provided; limit sideloading and review OnePlus Cloud session/devices where available
Longer-term hardening
- Use MDM/app-vetting to flag non-OnePlus apps requesting OnePlus custom permissions
- Track OnePlus security bulletins and Doyensec's post for restoration of technical details
Weaknesses (CWE) in OnePlus OEM App (com.oneplus.account) Exported Provider
Timeline of OnePlus OEM App (com.oneplus.account) Exported Provider
- Doyensec reports the OnePlus account-app token exposure to OnePlus as critical severity.
- OnePlus confirms the vulnerability but downgrades severity to high.
- OnePlus awards a USD 720 bounty for the report.
- Doyensec retests on OnePlus 13R firmware CPH2691_16.0.10.500(EX01); token exposure still present, vulnerability unpatched.
- SecurityOnline and Anti-Malware.ru report the technical details (com.oneplus.account, OPAccountProvider, get_account_oneplus_token) and the absence of a patch.
- After a last-minute OnePlus request, Doyensec temporarily takes the technical details offline and grants one final, limited remediation window.
- Doyensec (Szymon Drosdzol) publishes 'Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability', stating the issue remains unresolved 9+ months after report.
- SecurityLab.ru reports the disclosure (lists 11 September as the public disclosure date) and notes no patch has been announced.
Sources cited for OnePlus OEM App (com.oneplus.account) Exported Provider
- Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability (Doyensec)
- OnePlus session takeover vulnerability (SecurityOnline)
- OnePlus 13R отдаёт токен аккаунта любому приложению с нужной строчкой (Anti-Malware.ru)
- OnePlus: девять месяцев без исправления и перехват сессии в предустановленном приложении (SecurityLab)
- Android Developers: <permission> element and protectionLevel
- MITRE ATT&CK Mobile T1635 Steal Application Access Token
Detection coverage for TL-2026-4852
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4852 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.