CVE-2022-36876: Samsung Pass

Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication.

Affected products

• Samsung Samsung Pass: before 4.0.04.10 (fixed in 4.0.04.10)

Published 2022-09-09. Last modified 2026-06-17.