CVE-2026-94540 Details
Description
DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user interaction. Attackers can exploit the unauthenticated local service through same-device loopback to perform privileged SMS operations using the victim application's permissions.
A vulnerability in DesktopSMS version 1.11.0 allows local attackers to bypass pairing authorization and gain unauthorized access to SMS functionalities. By exploiting an unauthenticated local service through same-device loopback, attackers can send SMS messages, retrieve SMS-related content, and persist a selected paired identity, all without user interaction or the need for specific SMS permissions. This exploitation occurs using the permissions of the victim application.
It is recommended to make the pairing-result receiver non-exported, replace externally forgeable pairing-result broadcasts with an app-private callback, bind pairing approval to a cryptographically unpredictable, single-use nonce, authenticate local service sessions and link them to the approved pairing transaction, reauthorize sensitive commands like SMS sending and conversation retrieval, and avoid treating user-supplied 'DeviceGuid' as proof of authorization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actuator/net.mrpear.apps.desktopsmslite | CISA-ADP | Source CodeVendor |
| https://github.com/actuator/net.mrpear.apps.desktopsmslite | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/desktopsms-unauthorized-access-via-local-service | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MrPear DesktopSMS | <= 1.11.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |