External risk intelligence

Shelter Authentication Bypass Allows User Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-107058

Shelter is an Android application designed to provide a work profile for isolating apps on a local device. It operates as a client-side utility on mobile devices, not as a public-facing network service, edge gateway, or internet-accessible API. Therefore, it is typically restricted to local execution and lacks the public-internet-facing surface characteristics defined by the scoring rubric.

Authentication Bypass

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Shelter application could allow unauthorized individuals to take over user accounts and control their services. This issue impacts how user authentication is managed within the app, potentially leading to the compromise of user data and application functionality.

Unauthorized account takeover is possible.
This affects user data and app control.
Confirm if Shelter is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by registering a malicious auth_key, which would then allow them to take over another user's binder service API and preference state. This could lead to unauthorized control and manipulation of user data and application functions.

No authentication required.
Registering a custom auth_key.
Complete takeover of user data.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the Shelter application could allow an unauthorized individual to register their own authentication key, potentially enabling them to take over another user's binder service API and preference settings. This could affect the integrity and availability of the user's application data and personalized settings within the Shelter work profile.

User's binder service API and preferences.
Malicious authentication key registration.
Unauthorized control over user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Shelter application, specifically affecting user authentication and state management. The first practical step is for the platform or application team to identify all devices running Shelter, confirm its business criticality, and locate the accountable owner for each instance. This will allow for a risk-based approach to remediation.

Platform and application teams own the issue.
Verify Shelter's presence and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Shelter and how is it used?

Shelter is an Android application that leverages the Work Profile feature to create a sandboxed, isolated environment on your device. Users rely on it to keep specific apps separate from their personal data, essentially managing two distinct user profiles on a single phone to improve privacy and application isolation.

What does CWE-287 mean for CVE-2026-107058?

CWE-287 refers to Improper Authentication. In the context of CVE-2026-107058, this means the application fails to correctly verify the identity of the person or process requesting access. Because of this weakness, an attacker can bypass standard security checks and impersonate authorized users to manipulate the app's internal services.

How can an attacker trigger this vulnerability?

An attacker triggers this by registering their own malicious authentication key within the application. This action effectively grants them control over the binder service API and user preferences. Simply using the application normally or performing standard tasks does not trigger the flaw; it requires the specific, intentional injection of this unauthorized key.

Do I need to worry about this if I use Shelter?

Halo Surface Signal indicates that Shelter is a client-side utility running locally on mobile devices. It is not an internet-facing service or an edge gateway. Because it lacks a public network surface, the risk of remote exploitation is very unlikely for the average user compared to a vulnerable server or public API.

What should I do if I have Shelter installed?

First, verify which devices in your environment currently run the Shelter application to understand your potential footprint. Once identified, treat the application as a localized risk. Stay informed about official updates from the developer and monitor the application's status to determine if you need to limit its use until a formal patch is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.