CVE-2020-16272

CRITICAL 9.1CVE-2020-16272 · Published 03/08/2020 · updated 17/06/2026

In short

CVE-2020-16272 is a CRITICAL (CVSS 9.1) vulnerability affecting keepassrpc (kee).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.4% of all vulnerabilities.
Fix: update to 1.12.0 or later.

Package	Affected versions	Patched versions
keepassrpc kee	`< 1.12.0`	`1.12.0`

Description

The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers to read and modify data in the KeePass database via an A=0 WebSocket connection.

References

danzinger.wien/exploiting-keepassrpc · Exploit
forum.kee.pm/t/a-critical-security-update-for-keepassrpc-is-available/3040 · Vendor Advisory

More vulnerabilities in keepassrpc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free