Do Son 
Preinstalled smartphone applications frequently operate with high system privileges. Security researchers recently uncovered a severe OnePlus session takeover vulnerability. This flaw directly impacts OnePlus 13R Android security. Malicious applications can exploit this weakness to steal authentication tokens and hijack user accounts.
Researchers at Doyensec discovered the issue while analyzing OEM applications on the OnePlus 13R. They extracted the firmware and examined exported activities and services. Their investigation focused on components with elevated permissions. They isolated a critical flaw in the device account management software.
The Root Cause of the Flaw
The core issue resides in the “com.oneplus.account” application. This application manages user authentication for OnePlus services. The app exports a specific content provider named “OPAccountProvider”. A custom permission protects this provider.
However, the developers made a critical error defining this permission. They failed to set the protection level to “signature”. Signature protection ensures that only applications signed by the same developer can access the component. Because this protection is missing, any third-party application can declare the required permission. Once declared, the third-party app gains full access to the exported provider.
How the Account Takeover Works
An attacker only needs to convince a user to install a seemingly harmless application. The malicious app does not require any special user prompts. It simply asks the system for standard internet access and the custom OnePlus permission.
Once installed, the malicious app queries the vulnerable provider. It sends a specific command string to the system. “After decompiling and some deobfuscation effort, we discovered that this provider takes a string command from the caller,” the researchers noted. When the provider receives the “get_account_oneplus_token” command, it returns a sensitive session token.
The Doyensec report highlights the danger. “Despite its name, the token represents an authenticated OnePlus Cloud session and can therefore be used by an attacker to impersonate the victim when interacting with the OnePlus Cloud API,” the researcher warns.
Executing the Attack
With the stolen token, the attacker controls the victim’s OnePlus Cloud session. They can send HTTP requests directly to the vendor API endpoints. For example, the attacker can target the “/uc/v1/user-info/update-real-name” endpoint. This allows them to silently alter the victim’s personal data.
The security team used dynamic instrumentation tools to observe the application behavior. They used Frida to intercept the OkHttp traffic. This allowed them to monitor how the application signed and encrypted requests before sending them to the remote API. This deep analysis revealed how the local software interacts with the broader cloud infrastructure.
This OnePlus session takeover vulnerability requires zero interaction from the victim after the initial app installation. The exploit bypasses standard Android security boundaries. The malicious app executes the attack in the background. It extracts the token, formats the web request, and communicates with the cloud servers undetected. A detailed vulnerability analysis provides further technical context regarding the HTTP interceptor chains used during the research.
Current Status and OnePlus 13R Android Security
Doyensec reported the vulnerability to the vendor in December 2025. The vendor confirmed the issue and awarded a $720 bug bounty in March 2026. The researchers suggested a straightforward fix. The vendor simply needs to apply the signature protection level to the custom permission.
Despite the disclosure, the threat remains active on newer firmware. Researchers retested the exploit in September 2026 on the latest firmware version. They confirmed that untrusted applications can still extract the account token.
The researchers did note a minor change in the vendor regional API mechanics. This change prevented the final account data modification step using US or EMEA accounts during recent tests. “Therefore, while we confirmed that the underlying vulnerability and token exposure remain present in the latest tested firmware, we did not reproduce the complete end-to-end exploit on that version.”
Users remain at risk of token exposure. Device owners should avoid installing applications from untrusted sources. Security experts advise monitoring device updates closely. Manufacturers must address OEM software flaws quickly to protect users from silent account compromises.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
