Tangem Android SDK ignored the offline card genuineness check on first scan
Who is affected
Android users of the Tangem app before 5.18.3 could see a card's first scan accepted even if the offline genuineness check failed. Tangem states this could not be exploited in real-life scenarios.
What happened
In the release notes for Tangem’s Android app version 5.18.3, dated 28 November 2024, Tangem states that a flaw in the logic of the offline wallet attestation (the genuineness check) was identified and fixed in the Tangem Android SDK. According to Tangem, the flaw caused verification results to be ignored during a card’s first scan.
The issue was published as CVE-2025-27839 on 7 March 2025. The record describes a logic flaw in operations/attestation/AttestationTask.kt in the Tangem SDK for Android before 5.18.3 that causes verification results to be disregarded during the first scan of a card. It classifies the weakness as CWE-1025 (comparison using wrong factors) and gives a CVSS 3.1 base score of 3.2 (low). The CVE record itself states that exploitation may not have been possible.
Tangem’s release notes say the likelihood of exploitation was impossible to implement in real-life scenarios and that the fix strengthens security. The GitHub commit and release tag cited in the CVE record no longer resolve in the public tangem-sdk-android repository.
A Cold Wallet is a cryptocurrency wallet that stores private keys offline, providing enhanced security by being disconnected from the internet.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Software vulnerability) and the glossary terms that describe it.
How to Protect Your Crypto from Hackers
Practical steps to protect your cryptocurrency from hackers, malware, phishing, and social engineering attacks.
Read GuideHow to Send Crypto Safely
Sending crypto can be scary — one wrong address and funds are gone forever. Follow this guide to send safely.
Read GuideMalware
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Blind Signing
Blind signing is the process of signing a transaction without viewing its contents, typically used in hardware wallets for enhanced security.
Cite this entry
WalletInsights. “Tangem Android SDK ignored the offline card genuineness check on first scan”. Hardware wallet security incident tracker. Last verified November 4, 2026. https://walletinsights.io/en/security-incidents/tangem-android-sdk-attestation-first-scan-2024/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.