← Vulnerability feed

Vulnerability record · CVE-2021-25374 · published 9 April 2021

CVE-2021-25374: Samsung members improper authorization vulnerability

Samsung · Members

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.

7.5 CVSS 3.1 High EPSS 3.1% · top 12.9% CWE-285 · Improper authorization
7.5CVSS 3.1 base score, v2 5.0
3.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security.samsungmobile.com/ Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb Vendor Advisory
https://security.samsungmobile.com/ Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb Vendor Advisory

Track CVE-2021-25374 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2025-20949Samsung members path traversal vulnerabilityPath traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilege of Sa…EPSS 0.32%8.1CVE-2025-21079Samsung members vulnerabilityImproper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity…EPSS 0.54%7.8CVE-2021-25438Samsung members improper access control vulnerabilityImproper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and…EPSS 1.7%7.0CVE-2026-20985Samsung members vulnerabilityImproper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activit…EPSS 0.29%6.9CVE-2026-21037Samsung members vulnerabilityImproper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity w…EPSS 0.11%5.5CVE-2022-30748Samsung members vulnerabilityUnprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity.EPSS 0.22%5.1CVE-2026-20986Samsung members path traversal vulnerabilityPath traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members.EPSS 0.16%4.6CVE-2025-20898Samsung members vulnerabilityImproper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles.EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2021-25374), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.