Backup File Exposure in Chess Play and Learn App

Executive Summary

CVE-2026-13514 is a security vulnerability in the Chess Play and Learn Android app (up to version 4.9.42) caused by improper configuration of the AndroidManifest.xml file. Specifically, the app had the setting android:allowBackup="true" enabled, which allows attackers with physical access to the device and USB debugging enabled to extract the app's backup data using ADB without needing root access.

Within the extracted backup, sensitive information such as a plaintext Google OAuth JWT token was found. This token contains user identity details including email, name, profile picture URL, and OAuth identifiers. The exposure of this token can lead to identity theft or session abuse.

The vulnerability arises from the combination of allowing backups and storing sensitive tokens in plaintext within the app's shared preferences.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact users by exposing sensitive authentication tokens if an attacker gains physical access to their device with USB debugging enabled.

An attacker could extract the backup data and retrieve the plaintext Google OAuth JWT token, which contains personal identity information such as email and profile details.

With this token, attackers could potentially perform identity theft, abuse user sessions, or carry out further OAuth-related attacks, compromising the user's account security.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Chess Play and Learn App on an Android device has the AndroidManifest.xml file configured with android:allowBackup="true". This setting allows backup of the app data via ADB.

To detect the vulnerability, you can use ADB commands on a physical device with USB debugging enabled to attempt to create a backup of the app data and inspect it for sensitive information such as plaintext OAuth tokens.

• Connect the Android device via USB and ensure USB debugging is enabled.
• Run the command: adb backup -noapk com.chess
• Extract the backup file and inspect the shared_preferences directory for plaintext OAuth JWT tokens or other sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Chess Play and Learn App to a version where this vulnerability is fixed.

Additional recommended actions are to disable ADB backup for the app by setting android:allowBackup="false" in the AndroidManifest.xml, exclude sensitive files from backups, and avoid storing sensitive tokens in plaintext.

Using EncryptedSharedPreferences or storing tokens securely in the Android Keystore can further protect sensitive information.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes sensitive user information such as Google OAuth tokens in plaintext, which can lead to identity theft, session abuse, or further OAuth-related attacks. This exposure of personal and authentication data could result in non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Specifically, the improper configuration allowing backup extraction of sensitive tokens without root access increases the risk of unauthorized data disclosure, potentially violating principles of data confidentiality and integrity mandated by these standards.

Useful 0 Not Useful 0