Hello Flutter Community,

We are experiencing High level Vulnerability under the package that we are using local_auth. This local_auth package internally using the local_auth_android package that is causing the problem.

Security Scanning Orchestrator: Ostorlab
OS: Android
Problem:
Android provides mechanisms to enforce biometric authentication to protect sensitive information. Biometric authentication has evolved over time to provide improved user experience, developer experience and improved security.
Previous implementation using FingerprintManager is deprecated and must not be used. Proper implementation must useBiometricManager with BiometricPrompt and CryptoObject.
CryptoObject provides cryptographic primitives for encryption, decryption and signature validation.
In the example below, calling the authenticate method without cryptoObject is vulnerable to authentication bypass:

Proofs:

Attached the screenshots.

Would you please let me know whether we have an any open Vulnerability or do we need to create new. If yes, Would you please provide us the link where we can report about this.

Thanks,
Venkata.