What is GHSA-2wcf-xfj4-4xc8?

GHSA-2wcf-xfj4-4xc8 is a security advisory published by GitHub Security Advisories with Critical severity. An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a...

Which CVE IDs does GHSA-2wcf-xfj4-4xc8 cover?

GHSA-2wcf-xfj4-4xc8 covers the following CVE IDs: CVE-2026-107058. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2wcf-xfj4-4xc8?

GHSA-2wcf-xfj4-4xc8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-2wcf-xfj4-4xc8CriticalCVSS 9.8

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-107058 →

📋 Description

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-107058
https://f-droid.org/packages/net.typeblog.shelter
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md
https://github.com/PeterCxy/Shelter
https://github.com/advisories/GHSA-2wcf-xfj4-4xc8