RESEARCHERS have disclosed a severe OnePlus session takeover vulnerability that affects OnePlus 13R Android devices. The flaw resides in the device account management software, specifically the com.oneplus[.]account application and its exported content provider OPAccountProvider. The bug stems from the provider’s protection: a custom permission guarding it was defined without the required signature protection level.
Because signature protection is absent, any third‑party app can declare the permission and gain full access to the exported provider, enabling a remote attack vector without user interaction beyond initial app installation.
In practice, an attacker need only persuade a user to install a benign‑looking app. The malicious app requests internet access and the custom OnePlus permission, then queries the vulnerable provider. It sends a crafted command string; when the provider receives the command get_account_oneplus_token, it returns a token that represents an authenticated OnePlus Cloud session.
With this token, the attacker can impersonate the victim against the OnePlus Cloud API, altering personal data via endpoints such as /uc/v1/user-info/update-real-name. Security researchers used Frida to monitor OkHttp traffic and observed how requests are signed and encrypted. The exploit reportedly requires zero user interaction after installation and can operate in the background, bypassing standard Android security boundaries.
Doyensec reported the issue to OnePlus in December 2025 and received a $720 bounty in March 2026; tests in September 2026 showed the token exposure remains on newer firmware, though a regional API change prevented a complete end‑to‑end exploit in the latest version. Users are advised to avoid untrusted apps and monitor OTA updates closely while OnePlus addresses the underlying permission protection.