{"id":"CVE-2026-110618","summary":"SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API","details":"SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.","modified":"2026-10-17T02:30:26.447851545Z","published":"2026-10-14T14:16:56.635Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110618.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110618.json"},{"type":"ADVISORY","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/H1ue_ahiMe"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110618"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/smsforwarder-through-3.5.0-missing-authentication-in-http-server-remote-control-api"},{"type":"PACKAGE","url":"https://github.com/pppscn/SmsForwarder"},{"type":"ARTICLE","url":"https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/server/component/AppMessageConverter.kt#L93-L96"},{"type":"ARTICLE","url":"https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/utils/HttpServerUtils.kt#L35-L38"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pppscn/smsforwarder","events":[{"introduced":"0"},{"fixed":"f93f5889d92b50f6550e92c07bb07a5584eec650"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"3.5.0"},{"fixed":"3.5.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v3.3.2","v3.3.1","v3.3.0","v3.3.0-alpha","v3.2.0","v3.1.1","v3.1.0","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.1","v2.2.0","v2.1.0","v2.0.0","1.7.4","1.7.0","1.6.0","1.5.0","1.4.0","1.3.0","1.2.0","1.1.0","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110618.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}