{"id":"CVE-2026-107058","published":"2026-10-29T17:17:58.620","lastModified":"2026-10-29T20:17:25.220","description":"An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://f-droid.org/packages/net.typeblog.shelter/","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","tags":[]},{"url":"https://github.com/PeterCxy/Shelter","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","tags":[]},{"url":"https://github.com/PeterCxy/Shelter","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md","tags":[]}],"hasPoc":true,"ai":{"summary":"An authentication bypass in Shelter v445 allows unauthenticated attackers to register their own auth_key and hijack another user's binder service API and shared preferences, leading to full account takeover.","exploitability":"Exploitation requires network access and knowledge of the vulnerable endpoint; no user interaction or prior authentication is needed.","blast_radius":"Successful exploitation grants attackers full control over victim sessions, enabling data exfiltration, privilege escalation, and persistent compromise of the affected application.","remediation":"Upgrade to Shelter versionCode 446 or later, which patches the auth_key registration flaw.","detection":"Monitor for anomalous binder service calls with unexpected auth_keys or duplicate auth_key registrations from the same device; no reliable network or host artefact is described in the CVE.","tags":["auth-bypass","account-takeover","binder-api","android"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:17:29.209Z"}}