A high-severity local authentication bypass in MrPear DesktopSMS allows unprivileged Android applications to act as a privileged SMS proxy, posing a critical risk to user communications.

This vulnerability is a missing authentication flaw (CWE-306) within the local service running on the device. An unprivileged application can communicate via a same-device loopback interface (127.0.0.1:8000) to forge pairing approval and execute privileged SMS operations without the user granting sensitive permissions.

The ability for an unprivileged application to intercept or send SMS messages represents a significant threat to data privacy and multi-factor authentication (MFA) security. Because the application can retrieve conversation content, attackers could potentially steal sensitive information or bypass SMS-based verification codes, leading to account takeover. The CVSS score of 7.7 reflects the high impact on confidentiality and integrity, despite the requirement for local execution on the device.

Immediate Action: Currently, there is no official patch available; users should monitor the vendor for security updates and consider uninstalling the application if it is not strictly required for business operations.

Proactive Monitoring: Security teams should monitor for suspicious applications on mobile devices that request the INTERNET permission while exhibiting unusual behavior related to SMS service interactions.

Compensating Controls: Since this is a local service vulnerability, ensure that mobile device management (MDM) policies restrict the installation of unauthorized or untrusted third-party applications.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up by Edward "Actuator" Warren.

Given the severity of this unauthorized access flaw, organizations should prioritize the removal of DesktopSMS from managed devices until a verified security patch is released by the vendor. The ease with which an unprivileged application can leverage this service for malicious purposes necessitates immediate action to prevent potential data exfiltration and identity compromise.