CVE-2026-107058

Summary

An authentication bypass in Shelter v445 allows unauthenticated attackers to register their own auth_key and hijack another user's binder service API and shared preferences, leading to full account takeover.

Exploitability

Exploitation requires network access and knowledge of the vulnerable endpoint; no user interaction or prior authentication is needed.

Blast radius

Successful exploitation grants attackers full control over victim sessions, enabling data exfiltration, privilege escalation, and persistent compromise of the affected application.

Detection

Monitor for anomalous binder service calls with unexpected auth_keys or duplicate auth_key registrations from the same device; no reliable network or host artefact is described in the CVE.

Prioritized remediation

Upgrade to Shelter versionCode 446 or later, which patches the auth_key registration flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.