In short: Researchers at Doyensec found that any Android app installed on a OnePlus 13R can silently steal the user's OnePlus Cloud session token by exploiting a missing permission flag in the preinstalled com.oneplus.account application. OnePlus acknowledged the flaw as high-severity and paid a $720 bug bounty in March 2026, but the vulnerability remains unpatched nearly nine months after disclosure. The device is still vulnerable in September 2026.
What happened
On December 30, 2025, Doyensec researchers responsibly disclosed a vulnerability in com.oneplus.account, the preinstalled app that manages authentication for OnePlus services — OnePlus Cloud, MyOnePlus accounts, and related systems.
The vulnerable component is OPAccountProvider. The flaw is the absence of protectionLevel="signature" on the com.oneplus.account.READ_ACCOUNT_INFO permission. Without this restriction, any third-party app that simply declares the permission in its Android manifest gains free access to the provider and can retrieve the user's active OnePlus Cloud session token — with no dialog, no warning, and no user interaction required. See the features page for more on how layered app and protocol protection works.
Researchers demonstrated that the stolen token is accepted by OnePlus servers and can be used to read and modify personal data in OnePlus Cloud. Full account takeover for users in the US and EMEA was partially blocked by server-side changes, but the token leak itself remains exploitable.
Timeline: nine months and still unpatched
In March 2026, OnePlus formally acknowledged the vulnerability as high-severity and paid the researchers a $720 bug bounty. No security update was released.
In September 2026, Doyensec re-tested a device running firmware CPH2691_16.0.10.500(EX01) and confirmed the flaw persists. From responsible disclosure to public notification: nine months. Zero patch.
How serious is the threat
The exploit is deliberately simple. A malicious app needs nothing more than a single line in its manifest — the READ_ACCOUNT_INFO permission. Once installed, it silently retrieves the active session token with no prompts and no alerts. No complex exploit chain, no privilege escalation required.
The practical impact for affected users includes:
- unauthorised access to OnePlus Cloud — photos, device backups, personal settings;
- modification or deletion of data stored in the cloud;
- use of the stolen token as a stepping stone for targeted phishing or broader account takeover.
This is a reminder of a systemic risk category: not a malicious website, not a brute-forced password — the manufacturer's own preinstalled software becomes the attack surface. We cover threats like this regularly in the LiMP VPN privacy blog.
Why the fix is delayed
From a technical standpoint the fix is trivial. Doyensec noted that adding a single word — the signature keyword — to the permission definition would restrict access to the OPAccountProvider to apps signed with OnePlus's own certificate. One word. Nine months of waiting.
OnePlus has not publicly explained the delay. The Android OTA update cycle is a known bottleneck: a vendor must build the fix, validate it internally, obtain carrier approval in many regions, and stage the rollout — a process that routinely takes months even for critical issues.
Steps you can take right now
Until an official update is released, researchers recommend the following.
Install apps only from trusted sources. A malicious APK sideloaded from an unofficial source is the primary exploitation vector for this flaw. Limiting installs to Google Play and official vendor channels significantly reduces the risk.
Check for system updates now. Settings → About phone → System update. As soon as a patch appears, install it immediately.
Review app permissions. In Settings → Apps, verify that unfamiliar applications have not been granted access to account-related or system features.
Encrypt your traffic on public networks. A VPN does not close this firmware vulnerability, but on public Wi-Fi it encrypts the connection between your device and the internet — preventing network-level credential interception. The LiMP VPN app is a strict no-logs service for iOS and Android. Check the plans.