If you’re using a Samsung Galaxy phone, you’re probably familiar with Samsung Pass—Samsung’s built-in password manager and autofill service. It stores your credentials securely and makes logging in to apps and websites much easier with biometrics like fingerprint or face recognition.

But in late 2022, researchers discovered a critical security flaw—CVE-2022-39892—that could let attackers access your saved data on Samsung Pass, without you ever knowing.

In this post, we’ll break down what happened, how attackers could exploit the bug, give you the technical lowdown (including code hints), and most importantly: what you should do if you’re running an affected Samsung device. We use plain English and avoid jargon where possible, so anyone can follow.

The Heart of the Problem: “Keep Open” Gone Wrong

Samsung Pass has a feature called "Keep Open". If you’re in a rush, you might appreciate not having to unlock your phone or prove your identity each time you want to access your passwords. That’s where "Keep Open" comes in. It keeps the session active for a short time period after first use.

Sounds convenient, right? Unfortunately, before version 4..05.1, Samsung Pass didn't check properly if a user was *actually* authenticated when accessing certain sensitive features—even when "Keep Open" was enabled. This means even someone who isn’t logged in, or wasn’t you, could access your data!

The bug qualifies as an improper access control vulnerability—basically, a security hole where the system doesn’t verify if someone should get access, but lets them in anyway.

Samsung Pass versions earlier than 4..05.1

- Most Samsung Galaxy phones and tablets with Samsung Pass built-in (especially popular models from 202, 2021, and early 2022)

Here’s how an attacker could exploit this in the real world

1. Get Temporary Physical Access: Maybe you hand your phone to a friend, or someone grabs it when you’re distracted.
2. Check If Samsung Pass is “Kept Open”: The "Keep Open" feature is unintentionally keeping the session alive.
3. Access Without Authentication: The attacker opens Samsung Pass or an app that uses Samsung Pass’ autofill, and—because of the bug—they get access to your stored passwords, form autofill data, or credit card info… all without a fingerprint, PIN, or face scan.

The worst part: No system log, no warning, and no easy way for normal users to notice that their data has leaked.

This is a simplified take on what happened in the code (for educational purposes)

// Hypothetical Samsung Pass session handling code
if (user.isSessionKeptOpen()) {
    // Vulnerable code: allows access without re-confirming user identity!
    displayUserPasswords(); // BAD: Skips authentication!
} else {
    promptForBiometricAuth(); // Secure option
}

What’s wrong here?

- The code checks if “Keep Open” is enabled, and then shows the passwords *without* confirming it’s still the real user in possession of the device.
- Proper access control would re-prompt for biometric or PIN authentication, even with “Keep Open.”

Sensitive credentials become visible—*no authentication needed*.

The problem: the “Keep Open” feature persisted longer than intended, and did not check the user at access time.

Official References and More Reading

- Original NVD entry: NIST NVD - CVE-2022-39892
- Samsung security bulletin: Samsung Mobile Security - SVE-2022-39892
- MITRE CVE record: CVE-2022-39892

How Do I Protect Myself?

If you use Samsung Pass:  
1. Update Samsung Pass immediately from the Galaxy Store or Google Play Store. Look for version 4..05.1 or later.

Disable “Keep Open” unless you really need it (settings inside Samsung Pass).

If you’ve shared your device:  
- Change your most sensitive passwords, and check for unusual activity on accounts that used Samsung Pass.

Conclusion

This bug is a classic case of convenience trumping security, and a great reminder to always update your apps and operating system. Samsung patched this quickly, but many users don’t even know such a flaw existed.

Your stored passwords are only as safe as the app that manages them. When in doubt, always check for updates and review which features (like “Keep Open”) might make things easier for attackers.

Spread the word—your security might just depend on it.


If you found this post helpful, share with other Samsung users, and bookmark the official links above for any new updates. Stay secure!

Timeline

Published on: 11/09/2022 22:15:00 UTC
Last modified on: 11/10/2022 18:56:00 UTC