ZDI 2026-03-16

ZDI-26-210: (Pwn2Own) Samsung Galaxy S25 Samsung Members Security Feature Bypass Vulnerability

CVE-2025-21079 +1

Machine-generated analysis · WAYSCloud LLM

The vulnerability enables remote security feature bypass on the Samsung Galaxy S25 without requiring authentication.

Context

The affected product is the Samsung Galaxy S25, specifically involving the Samsung Members application or related security feature. The vulnerability is a security feature bypass that can be exploited remotely without authentication. The CVSS score is rated at 5.4, indicating a medium severity impact. Worth noting is that this was disclosed as part of the Pwn2Own competition, suggesting it was demonstrated in a controlled setting.

Operator considerations

Check: whether Samsung Members is installed and active on Samsung Galaxy S25 devices.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to bypass a security feature on affected installations of Samsung Galaxy S25. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2025-21079.

Read the full advisory on ZDI →

Related advisories