{"id":"CVE-2026-107030","kind":"vulnerability","aliases":["CVE-2026-107030"],"related":[],"title":"YubiClip XOR fork: insecure permissions let attackers disrupt OTP clipboard timing","description":"Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.","summary":"The craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) has insecure permissions that let an unauthorized party trigger its one-time password clipboard mechanism. The result is a desynchronized timing of that mechanism, according to the description.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","otp","package","yubiclip"],"not_affected_if":["other-yubiclip-builds"],"how_to_check":"- Check whether the installed app is the craftxbox YubiClip XOR fork at version `1.0.1` with versionCode `10003`.\n- Whether the app's exported components or permissions allow outside triggering is unknown from the sources.","fix":null,"status":"open","published_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:30+00:00","updated_at":"2026-10-29T16:33:30+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T16:33:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"YubiClip XOR fork: insecure permissions let attackers disrupt OTP clipboard timing","impact":"low","summary":"The craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) has insecure permissions that let an unauthorized party trigger its one-time password clipboard mechanism. The result is a desynchronized timing of that mechanism, according to the description.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","yubiclip","otp"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"OTP clipboard timing gets desynchronized by an unauthorized trigger","analyst_note":"Confirm the exposed permission or component and whether a fix exists in the upstream fork, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107030.","how_to_check":"- Check whether the installed app is the craftxbox YubiClip XOR fork at version `1.0.1` with versionCode `10003`.\n- Whether the app's exported components or permissions allow outside triggering is unknown from the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["other-yubiclip-builds"],"who_is_affected":"Only users of the craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) appear affected, per the description. The sources do not describe the exact permission flaw or which configurations are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000696,"input_tokens":4119,"output_tokens":569,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107030':14A,17A '-2026':13A,16A '10003':29B,68C 'accord':55B 'allow':69C 'android':18B 'attack':7A,71C 'caus':83C 'clipboard':10A,44B,77C 'craftxbox':23B,62C 'cve':12A,15A 'descript':58B 'desynchron':50B,85C 'disrupt':8A 'fork':3A,26B,65C 'insecur':4A,31B,59C 'let':6A,34B 'mechan':45B,54B,82C 'one':41B,79C 'one-tim':40B,78C 'otp':9A,19B,76C 'otp-clipboard':75C 'packag':20B 'parti':37B 'password':43B,81C 'permiss':5A,32B,60C 'result':47B 'time':11A,42B,51B,80C,88C 'trigger':38B,73C 'unauthor':36B,70C 'v1.0.1':27B,66C 'versioncod':28B,67C 'xor':2A,25B,64C 'yubiclip':1A,21B,24B,63C","nicknames":[],"mitigations":[],"who_affected":"Only users of the craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) appear affected, per the description. The sources do not describe the exact permission flaw or which configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107030","severity":null,"published_at":"2026-10-29T16:17:48+00:00","modified_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}