CVE-2026-107058 in Shelter
Summary
by MITRE • 10/29/2026
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Shelter, specifically affecting the build with version code 445, represents a critical authentication bypass that compromises the integrity of user-specific data isolation mechanisms. This application is designed to provide work profile management on Android devices, relying heavily on secure separation between personal and professional environments. The core technical flaw lies in the handling of authentication keys during session initialization or service binding processes. Instead of strictly validating that an incoming auth_key corresponds exclusively to the requesting process identity or user context, the implementation allows external entities to inject arbitrary key values. This lack of strict origin validation enables attackers to register their own auth_key and subsequently use it to impersonate legitimate users within the binder service architecture.
From a technical perspective, this flaw exploits weaknesses in inter-process communication security models often found in Android applications that utilize AIDL or similar binding mechanisms for internal services. The vulnerability allows an attacker to bypass authentication checks by supplying a crafted auth_key that is accepted as valid without sufficient verification against the caller's UID or package signature. This effectively neutralizes the intended access control restrictions, granting unauthorized entities full read and write access to sensitive API endpoints and preference states belonging to other users on the device. The ability to register arbitrary keys suggests a failure in key generation or validation logic where uniqueness and binding to specific user contexts are not enforced at the cryptographic or application layer.
The operational impact of this vulnerability is severe, as it leads directly to account takeover scenarios within the context of the Shelter environment. An attacker who successfully exploits this flaw can access private preference data, which may contain sensitive configuration settings, cached credentials, or other personally identifiable information stored by the victim user. Furthermore, control over the binder service API allows for manipulation of application state and potentially further escalation privileges depending on how these services interact with system-level components. This compromises not only confidentiality but also integrity, as attackers can alter preferences to disable security features or redirect functionality maliciously.
This vulnerability aligns closely with CWE-287, which describes Improper Authentication, specifically where the software does not adequately verify that an entity is who it claims to be before granting access. Additionally, from a threat modeling perspective using MITRE ATT&CK frameworks, this behavior corresponds to techniques related to Impair Defenses and potentially Initial Access if leveraged in conjunction with other vectors for lateral movement within managed device environments. The exploitation path typically involves local privilege escalation or cross-user data theft on shared devices such as corporate-owned personally enabled phones where multiple user profiles might exist.
Mitigation strategies must focus on enforcing strict identity verification during the authentication key registration and validation phases. Developers should implement robust checks that bind auth_keys to specific process identities, ensuring that keys cannot be reused across different users or processes without explicit re-authentication. Implementing mutual TLS for internal service communication, although challenging in Android environments, can add a layer of security by verifying certificate chains associated with each binder caller. Additionally, adopting principle of least privilege ensures that even if an auth_key is compromised, the scope of actions available through the API remains limited to essential operations only. Regular code audits focusing on IPC security and automated testing for authentication bypasses are recommended to prevent similar flaws in future releases.