CVE-2026-94540: DesktopSMS Auth Bypass Vulnerability

CVE-2026-94540 Overview

CVE-2026-94540 is an unauthorized access vulnerability in DesktopSMS version 1.11.0 by MrPear. The application exposes a local service that accepts requests without authentication, pairing confirmation, or user interaction. A local attacker with same-device loopback access can invoke privileged SMS operations using the victim application's permissions. Exploitation allows an attacker to transmit SMS messages, retrieve SMS-derived content, and persist an attacker-controlled paired identity on the device. The weakness is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
A co-resident local application can silently send SMS messages, exfiltrate SMS content, and bind the victim's DesktopSMS instance to an attacker-selected paired identity without user consent.

Affected Products

DesktopSMS 1.11.0 by MrPear
Android package net.mrpear.apps.desktopsmslite
Deployments exposing the local pairing service on the loopback interface

Discovery Timeline

2026-09-21 - CVE-2026-94540 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94540

Vulnerability Analysis

DesktopSMS 1.11.0 runs a local service intended to communicate with a paired desktop client over the device loopback interface. The service accepts commands without verifying that the caller has completed the pairing workflow. Any process on the same device that can open a loopback socket to the service can therefore issue privileged commands. Because those commands execute inside the DesktopSMS process, they inherit the SMS permissions granted to the application. The result is that a low-privilege co-resident app can send outbound SMS, read SMS-derived data returned by the service, and overwrite the stored paired identity so that subsequent legitimate traffic is redirected to attacker-controlled infrastructure.

Root Cause

The root cause is missing authentication on a critical function, classified as [CWE-306]. The local service treats loopback origin as sufficient trust and does not require the pairing handshake, a shared secret, or explicit user confirmation before executing privileged SMS operations or mutating pairing state.

Attack Vector

Exploitation requires local code execution on the same Android device where DesktopSMS is installed. A malicious app with only network socket capability, and no SMS permissions of its own, opens a connection to the DesktopSMS local service and issues crafted requests. The service processes the requests as if they originated from a trusted paired client. No user interaction, prompt, or pairing challenge is triggered during the attack.

No verified public proof-of-concept code is available. Refer to the VulnCheck Security Advisory and the GitHub Project Repository for additional technical details.

Detection Methods for CVE-2026-94540

Indicators of Compromise

Unexpected SMS messages sent from the device with no corresponding user action in the DesktopSMS UI.
Changes to the stored paired-desktop identity or pairing metadata that were not initiated by the user.
Loopback connections to the DesktopSMS local service originating from processes other than the legitimate desktop bridge.

Detection Strategies

Inspect installed Android packages for net.mrpear.apps.desktopsmslite at version 1.11.0 and flag vulnerable installations.
Monitor mobile telemetry for anomalous SMS send volume or SMS reads occurring outside normal user activity windows.
Correlate local socket activity on the DesktopSMS listening port with the process identifiers of connecting apps to detect unauthorized clients.

Monitoring Recommendations

Alert on any modification to DesktopSMS pairing state that is not accompanied by a foreground user interaction event.
Track outbound SMS records from managed devices and compare against expected messaging patterns for the user.
Review mobile threat defense logs for co-resident apps that request network sockets while lacking a legitimate need for local IPC.

How to Mitigate CVE-2026-94540

Immediate Actions Required

Uninstall DesktopSMS 1.11.0 from managed and personal Android devices until a fixed release is published.
Revoke any desktop pairings created by DesktopSMS and rotate credentials that may have been transmitted through affected devices via SMS-based one-time passwords.
Restrict installation of untrusted third-party applications on devices where DesktopSMS remains installed.

Patch Information

No vendor patch is referenced in the NVD entry or the linked advisories at time of publication. Monitor the GitHub Project Repository and the VulnCheck Security Advisory for a fixed release.

Workarounds

Remove the application from devices that store or receive sensitive SMS content, including SMS-based multi-factor authentication codes.
Enforce a mobile application allowlist that blocks installation of unvetted apps capable of opening local sockets alongside DesktopSMS.
Where the app must remain installed, disable it via device management until a vendor fix is available.

bash

# Configuration example: enumerate and remove the affected package via adb
adb shell pm list packages | grep net.mrpear.apps.desktopsmslite
adb uninstall net.mrpear.apps.desktopsmslite