Junglewise Threat Intelligence

CVE-2026-94540: MrPear DesktopSMS Lite authentication bypass in local service

CVE-2026-94540 · Severity: high · CVSS 7.7 · Published 2026-09-21

Executive brief

DesktopSMS Lite is an Android application that allows users to send and receive SMS messages from a desktop. The vulnerability permits any installed app with only basic internet permission to forge pairing approval with DesktopSMS Lite's local service, allowing the attacker to send SMS and read all stored SMS conversations without ever requesting SMS permissions. This could enable credential theft via SMS-based two-factor codes, unauthorized message sending, and privacy violation through message interception.

Technical details

DesktopSMS Lite runs an unauthenticated local service on 127.0.0.1:8000 that accepts pairing requests without validating the requestor's identity. An attacker app with only INTERNET permission can forge a COM_PAIR_REQUEST_RESULT result=true message with an attacker-controlled DeviceGuid to bypass the pairing authorization check. Once accepted, the forged identity gains access to privileged commands (sendsms.dsms.cmd.icl, search-conversations-request.dsms.cmd.icl) that execute SMS operations using DesktopSMS Lite's SMS permissions, even though the attacking app holds no SEND_SMS or READ_SMS permissions.

Affected products

  • MrPear DesktopSMS Lite 1.11.0

Timeline

  • 2026-09-21: disclosed

References