CVE-2026-94540

Received Received - Intake

Unauthenticated Local SMS Access in DesktopSMS 1.11.0

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user interaction. Attackers can exploit the unauthenticated local service through same-device loopback to perform privileged SMS operations using the victim application's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94540

EUVD

EUVD-2026-84215

Affected Vendors & Products

Vendor	Product	Version / Range
mrpear	desktopsms	1.11.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

DesktopSMS 1.11.0 by MrPear has an unauthorized access vulnerability allowing local attackers to send SMS messages, access SMS-related data, and set a paired identity without user interaction or confirmation. The flaw exists in the application's local service, which can be exploited via same-device loopback to perform privileged SMS operations using the app's permissions.

Detection Guidance

This vulnerability involves an unauthenticated local service in DesktopSMS 1.11.0 that allows unauthorized SMS operations. Detection requires checking for the presence of the vulnerable service and its exposed endpoints on the local system.

Impact Analysis

An attacker with local access to your device could send SMS messages, read your SMS content, or impersonate a paired device without your knowledge. This could lead to unauthorized charges, data leaks, or misuse of your messaging account.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive SMS content. Organizations handling regulated data must address this flaw to maintain compliance with privacy and security requirements.

Mitigation Strategies

Update DesktopSMS to the latest version if available. Disable or restrict access to the local service interface. Monitor for unauthorized SMS transmissions or paired identities.

Hi! I’m here to help you understand CVE-2026-94540. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70