A missing authentication vulnerability in the whuan132 AIBattery utility, specifically within the BatteryXPCService, allows a local user to bypass security controls and achieve unauthorized system impact.

This flaw is caused by missing authentication (CWE-306) in the AIBatteryHelper/XPC/BatteryXPCService.swift file. The vulnerability permits a local attacker with low privileges to interact with the service without proper validation.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level due to the potential for total impact on system confidentiality, integrity, and availability. While the attack requires local access, successful exploitation enables an attacker to manipulate core battery service functions, which could result in unauthorized system behavior or denial of service.

Immediate Action: Since a specific patch version is not currently identified, users should restrict local access to the affected system and monitor for unauthorized interaction with the AIBattery service. Disable the service if it is not strictly required for system operations.

Proactive Monitoring: Monitor system logs for unexpected execution of the BatteryXPCService or unauthorized XPC communication attempts. Review local user permissions to ensure that only authorized accounts can interact with sensitive system services.

Compensating Controls: Implement host-based access control lists to limit which local users or processes can communicate with the vulnerable XPC service.

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the technical write-up provided by the researcher at the referenced GitHub repository.

Given the existence of a public proof-of-concept and the high potential for impact on system integrity, this vulnerability should be prioritized for mitigation. Organizations should monitor vendor communications for a definitive patch and apply it immediately upon release to remediate the authentication flaw.