Unrated severityNVD Advisory· Published Feb 23, 2015· Updated Jun 17, 2026
CVE-2014-7922
CVE-2014-7922
Description
The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding _opt_ parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes including the SID and LSID scopes, and consequently obtain access to a Google account, via a crafted application, as demonstrated by setting the has_permission=1 parameter value upon finding _opt_has_permission in that argument.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<2015+ 2 more
- (no CPE)range: <2015
- cpe:2.3:a:google:play_services_sdk:*:*:*:*:*:*:*:*range: <=6.1
- (no CPE)range: <2015
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.