# OnePlus OEM App (com.oneplus.account) Exported Provider Exposes OnePlus Cloud Session Token – Session Takeover (Doyensec disclosure, unpatched)

> Doyensec reported that the preinstalled OnePlus account app (com.oneplus.account) on the OnePlus 13R exposes an authenticated OnePlus Cloud session token to any third-party app that declares a custom permission lacking signature-level protection. The issue was reported on 2025-12-30 and was still unpatched in a 2026-09-09 retest; technical details were temporarily withdrawn from the Doyensec post at the vendor's request.

- **Published:** 2026-10-30T20:10:46Z
- **Last reviewed:** 2026-10-30T20:10:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4852
- **ID:** TL-2026-4852
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Doyensec (researcher Szymon Drosdzol) analysed OEM applications preinstalled on the OnePlus 13R and found that the com.oneplus.account application exports a content provider, OPAccountProvider, that manages authentication for OnePlus services. Access to the provider is guarded by the custom permission com.oneplus.account.READ_ACCOUNT_INFO, but that permission is declared without android:protectionLevel="signature". Any third-party application can therefore declare the same permission in its manifest and is granted access without a user-facing warning.

When the provider receives the get_account_oneplus_token command it returns a token (the field is named oldSecondaryToken). Despite the name, this value is an active, authenticated OnePlus Cloud session credential. A malicious app holding only the INTERNET permission plus the custom OnePlus permission declaration can read it with zero further user interaction after installation, then replay it against the OnePlus Cloud API (host uc-client-fr.oneplus.com was shown to accept it) to impersonate the victim and read or modify account data. A reported example of a state-changing endpoint is /uc/v1/user-info/update-real-name, which allows silent alteration of the victim's personal data.

Disclosure timeline per secondary reporting: reported 2025-12-30 as critical; OnePlus confirmed on 2026-01-06 but downgraded the rating to high; a USD 720 bounty was awarded on 2026-03-12; the vulnerability was retested on 2026-09-09 on firmware CPH2691_16.0.10.500(EX01) and found still present. Doyensec published on 2026-09-10 and, after a last-minute vendor request, temporarily took the technical details offline and granted one final limited remediation window. Doyensec reported that regional API changes prevented end-to-end exploitation against US/EMEA accounts during the September 2026 retest, but the token exposure itself persisted.

No CVE, CVSS score, in-the-wild exploitation, public PoC, IOCs or threat-actor attribution is stated in the sources. The recommended fix is to apply android:protectionLevel="signature" to the custom permission so only OnePlus-signed apps can access the provider. Only the OnePlus 13R firmware above was explicitly confirmed vulnerable; other devices and versions were not stated in the sources.

## MITRE ATT&CK

- T1528 Steal Application Access Token
- T1635 Steal Application Access Token
- T1078.004 Valid Accounts: Cloud Accounts
- T1636 Protected User Data
- T1565.001 Data Manipulation: Stored Data Manipulation

## Sources

- [Preinstalled but Not Safe. OnePlus OEM App Session Takeover Vulnerability (Doyensec)](https://blog.doyensec.com/2026/09/10/oneplus-session-takeover.html)
- [OnePlus session takeover vulnerability (SecurityOnline)](https://securityonline.info/oneplus-session-takeover-vulnerability/)
- [OnePlus 13R отдаёт токен аккаунта любому приложению с нужной строчкой (Anti-Malware.ru)](https://www.anti-malware.ru/news/2026-09-10-111332/51372)
- [OnePlus: девять месяцев без исправления и перехват сессии в предустановленном приложении (SecurityLab)](https://www.securitylab.ru/news/577234.php)
- [Android Developers: <permission> element and protectionLevel](https://developer.android.com/guide/topics/manifest/permission-element)
- [MITRE ATT&CK Mobile T1635 Steal Application Access Token](https://attack.mitre.org/techniques/T1635/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4852