Executive brief
BitChat is a decentralized peer-to-peer messaging application that uses Bluetooth mesh networking to enable offline communication. A vulnerability in version 1.15.0 allows an attacker within Bluetooth range to inject unauthenticated or malformed messages into the local message cache, which then propagate automatically to other users during normal network synchronization. This can result in message spoofing, spam, denial of service, or degradation of message delivery reliability across the mesh network.
Technical details
The vulnerability is a cache poisoning flaw in BitChat's BLE gossip synchronization protocol (BLEService.swift). Attackers can send unauthenticated or unsigned MESSAGE packets to a node, which are incorrectly accepted and stored in the local message cache despite failing signature validation. BitChat's design treats cached messages as authoritative and redistributes them during synchronization with peer nodes, so a single poisoned cache entry spreads autonomously to other users without further attacker involvement. Attack vector requires only Bluetooth proximity (no authentication or network access); preconditions are minimal in mesh environments. The issue affects packet validation for both MESSAGE and file transfer (attachment) packets, indicating systemic weakness in cache admission enforcement. A patch was deployed on 2026-01-28.
Affected products
- BitChat BitChat for iOS 1.15.0
Timeline
- 2026-01-28: disclosed: Security audit by BARGHEST published; patch deployed same day
- 2026-08-28: advisory: CVE-2026-51376 published to NVD